IDF Probe: Hamas Used Emoji Code to Launch October 7 Attac

A newly published IDF General Staff investigation reveals that Hamas’s military wing used a specific sequence of emojis as the coded signal to launch the October 7 massacre. The findings, reported Monday and cleared for publication, mark the first public disclosure of the operational trigger behind the attack.

According to the probe, the agreed signal was not a verbal command or written order. Instead, Hamas terrorists used a recurring string of seemingly innocent WhatsApp emojis. The messages included hearts, stars, and flowers. They were exchanged between Hamas terrorists and members of the elite Nukhba force in the hours before the assault. At the time, the messages did not raise suspicion.

Investigators uncovered their meaning only after the war began. They analyzed thousands of seized mobile devices and identified a repeated pattern. Ultimately, they concluded that the emoji sequence served as the activation code.

Once terrorists received the signal, they moved to mosques or other designated gathering points for final instructions. From there, they retrieved weapons and equipment from their homes or from pre-stocked “combat bags” containing military and personal gear. The mobilization followed a structured pattern. Investigators later reconstructed that pattern through digital forensics and intelligence gathered during the fighting.

Notably, the same emoji sequence appeared previously in September 2022 and April 2023. Israeli defense officials now assess that Hamas intended during those periods to implement its broader invasion blueprint, known internally as “Jericho Wall.” However, the terror organization did not proceed at the time due to internal disagreements. The repetition of the same digital symbols across multiple timeframes led investigators to determine that the emojis consistently functioned as the code name for initiating large-scale action.

Meanwhile, the probe outlines a series of warning indicators during the night preceding the attack. Intelligence detected the activation of dozens of mobile phones using Israeli SIM cards. Officials also recorded increased cellular traffic, the removal of coverings from rocket launchers, heavy vehicle movement, and the opening of command centers.

In addition, investigators noted that some commanders descended into underground systems together with their families. Analysts later assessed that such a move would be unlikely during a routine exercise.

Despite these signs, the Shin Bet dispatched only one team from its “Tequila” unit to the south. Former Shin Bet chief Ronen Bar arrived at headquarters after midnight. However, reports indicate that separate intelligence prompted his arrival, not specifically the SIM card activity. According to security sources, similar SIM activations had occurred in the past without escalating into a major incident. As a result, officials viewed the development with reduced urgency compared to other indicators.

Only after the massacre did investigators identify the emoji signal as operationally significant. They reached that conclusion after mapping patterns across thousands of recovered devices belonging to Hamas terrorists who were captured or killed. The investigation concludes that although multiple anomalies surfaced overnight, Israeli intelligence did not interpret the coordinated meaning of the digital symbols in time.