TLDR
- Senior IRGC intelligence officers embezzled over $21 million in cryptocurrency while investigating Cryptoland exchange
- Mehdi Hajipour and Mehdi Badi led the scheme, moving tokens from seized assets to their personal wallets
- Cryptoland CEO Sina Estavi was tricked into paying $10,000 to “buy back” stolen tokens from a fabricated identity
- Estavi was sentenced to 15 years but fled Iran; he repaid $14 million to some investors
- About 25,000 investors remain uncompensated after the collapse of Cryptoland
The Crypto Heist
Iranian Revolutionary Guard intelligence officers stole around $21 million in cryptocurrency while pretending to investigate a corruption case, according to court documents and blockchain evidence. The scheme involved senior officers from the Islamic Revolutionary Guard Corps (IRGC) who were supposed to be investigating fraud at the Cryptoland exchange.
The case centers on Cryptoland, a digital exchange that was shut down after the May 2021 arrest of its CEO, Sina Estavi. At the time of his arrest, Estavi faced charges of “disrupting the economic system” but had no formal accusers.
Once news of his arrest spread, thousands of investors came forward with complaints. Iran’s Judiciary-controlled Mizan news website later reported over 51,000 plaintiffs in the case.
The Token Theft
Court filings point to Mehdi Hajipour and Mehdi Badi, two senior figures in the IRGC’s economic intelligence branch, as the main people behind the scheme. Blockchain records show that just one day after Estavi’s detention, six billion BRG tokens were moved from his crypto wallet.
This token transfer happened before the public knew about any potential scandal. The tokens were then sold by IRGC officers, generating millions of dollars for the interrogators themselves.
A court-appointed expert confirmed that wallets controlled by Hajipour alone processed and sold over $21 million worth of BRG, which was Cryptoland’s native token. Before the token theft, Hajipour’s assets were valued at only $40,000 (10 billion rials).
Four months later, his wealth had grown to over $14.2 million (600 billion rials). He reportedly used this money to buy gold, luxury real estate, and high-end vehicles.
The Wider Network
Hajipour and Badi didn’t work alone. The scheme also included at least two more IRGC interrogators – Majid Jahan Parto and Majid Tabatabaei. Four others reportedly helped by forging documents to make the transactions look legitimate.
Badi, who used the alias “Dr. Ebadi,” is the nephew of Ali Akbar Hosseini Mehrab. Mehrab formerly served as the Deputy for Economic Anti-Corruption Affairs at the IRGC intelligence organization.
In March 2022, Hajipour was caught in a sting operation. He was arrested after accepting a $10,000 bribe from Estavi. Estavi thought he was buying back stolen tokens from a third party.
That third party was actually a fake identity created by Hajipour himself. After his arrest, Hajipour was held in Ward 66, a special prison for IRGC personnel.
Hajipour’s appeal was later rejected in September 2022. However, there is little other information about what happened to the defendants in this case or what sentences they received.
Three months after Hajipour’s arrest, Hossein Taeb was removed from his position as head of the IRGC intelligence organization. He was replaced by Mohammad Kazemi.
The Aftermath
Estavi, who gained international attention for buying Twitter co-founder Jack Dorsey’s first tweet as an NFT for $2.9 million, was sentenced to 15 years in prison. His sentence also included 75 lashes, fines, and a lifetime ban from public service.
Despite a travel ban, Estavi managed to flee Iran. A video later showed him in France, and Iran’s judiciary confirmed he had escaped “in violation of legal prohibitions.”
While in prison, Estavi repaid $14 million to about 24,000 users from his accounts. However, around 25,000 other investors still haven’t been paid back.
These investors are owed money that was taken by Hajipour, Badi, and other members of the network. Following Estavi’s arrest, the value of the BRG token collapsed, leading to huge losses for investors.
The Cryptoland case is part of a broader pattern of crypto-linked crime involving Iranian nationals. Earlier this month, the U.S. Office of Foreign Assets Control (OFAC) sanctioned Behrouz Parsarad, an Iranian national.
Parsarad was the operator of the Nemesis darknet marketplace, which allegedly sold nearly $30 million in narcotics. According to OFAC, Parsarad controlled the site’s crypto wallets and took a percentage of every transaction.
U.S., German, and Lithuanian officials seized Nemesis’s servers in March 2024. Despite this, reports indicate that Parsarad has discussed starting a replacement marketplace with former vendors.
Stay Ahead of the Market with Benzinga Pro!
Want to trade like a pro? Benzinga Pro gives you the edge you need in today's fast-paced markets. Get real-time news, exclusive insights, and powerful tools trusted by professional traders:
- Breaking market-moving stories before they hit mainstream media
- Live audio squawk for hands-free market updates
- Advanced stock scanner to spot promising trades
- Expert trade ideas and on-demand support
