Shadow Economy: How IRGC Interrogators Heisted $21 Million from Iranian Investors

Summary

A major investigation, based on exclusive documents and evidence, reveals a sprawling case of theft, bribery, and extortion involving senior investigators of the Islamic Revolutionary Guard Corps (IRGC) Intelligence Organization. The documents detail how, under the pretext of confronting economic corruption, a group within the organization orchestrated the theft of approximately one thousand billion tomans (over $21 million at the time) from a single cryptocurrency exchange, CryptoLand.

The case first entered the public eye three years ago with the arrest of Sina Estavi, CEO of CryptoLand. At the time, defrauded investors gathered outside courts demanding justice and the return of their funds. The judiciary framed it as a massive fraud case involving over 51,000 plaintiffs who had purchased a volatile token called BRG. Estavi and an associate were tried and received lengthy prison sentences.

However, a deeper investigation into court files, audio recordings, and blockchain data uncovers a far more sinister plot. It indicates Estavi’s arrest itself was politically motivated and served as the starting pistol for a multi-layered heist carried out not by external criminals, but by the very investigators assigned to the case.

The Setup: A Coordinated Arrest and Immediate Digital Plunder

On May 17, 2021, IRGC Intelligence agents arrested Sina Estavi at his home. Hours later, an IRGC cyber unit announced his detention on his social media account, instantly triggering panic in the market for the BRG token, which he was associated with.

While Estavi was publicly charged with running an unauthorized exchange, his interrogation strayed far from finance. Investigators pressured him to confess to providing financial aid to former President Mahmoud Ahmadinejad’s election campaign and even attempted to falsely link him to Israeli intelligence.

Unbeknownst to the public, a parallel operation was already underway. Blockchain records show that a mere day after Estavi’s detention, six billion units of the BRG token began rapidly draining from his digital wallet into anonymous accounts.

For a full month, while Estavi was held incommunicado and even staged a hunger strike, the theft continued unabated. Court-appointed experts later confirmed the scale of this unauthorized transfer.

The Trap: An Investigator Poses as a Savior

Weeks after his release on bail in February 2022, Estavi was contacted by a mysterious figure calling himself “Shahrokh” on WhatsApp. This individual claimed a Turkish national named “Morad Biker” possessed Estavi’s stolen tokens and was willing to negotiate their return.

The contact quickly escalated to video calls, where “Shahrokh” revealed his true identity: he was an IRGC Intelligence interrogator named Behnam Hajipour. To prove his credentials, he brazenly video-called from inside IRGC Intelligence headquarters. Hajipour presented himself as a rogue insider willing to help Estavi recover the assets for a multi-million dollar payoff.

Estavi, suspicious, secretly recorded these interactions and reported them to another investigator within the system who was acting as his liaison. This set the stage for a sting operation.

The Sting: A Restaurant Rendezvous with Hidden Cameras

IRGC Counter-Intelligence, a separate and rival agency within the IRGC, took over the case. They equipped Estavi with hidden cameras and marked cash to meet Hajipour at a Lebanese restaurant in which Hajipour was ironically an investor.

The plan was for Estavi to hand over the cash as a "bribe" to finally receive the private keys to the wallets holding the remaining stolen tokens. Upon successful receipt, Estavi was to give a coded signal: “I’m craving strawberry juice.”

The sting unfolded perfectly. Seconds after the signal, Counter-Intelligence agents stormed in, arresting Hajipour before he could delete the digital wallets from his phone. Forensic analysis confirmed the wallets on his device contained over 3.7 billion of the stolen BRG tokens, conclusively proving “Morad Biker” was a fictional character Hajipour had invented.

The Unraveling: Following the Money and the Network

Court-appointed experts verified that Hajipour had already sold 2.41 billion of the stolen tokens. Calculating the value at the deflated post-arrest market rate, these sales netted approximately $21.7 million. At the time, this equaled a staggering 616 billion Iranian tomans.

Investigations into Hajipour’s finances revealed a dramatic and inexplicable wealth explosion. In the four months following the theft, his declared assets ballooned from 1 billion to 60 billion tomans.

He had purchased multiple apartments, luxury cars, gold, and invested in restaurant franchises. The probe widened, revealing Hajipour was not a lone operator. He was part of a network of senior IRGC Intelligence interrogators, including a key figure named Mehdi Badi. Badi, the nephew of a former high-ranking IRGC and provincial official, was himself implicated in separate multi-million dollar bribery schemes involving prominent Iranian businessmen and industrialists.

Evidence from interrogation sessions placed both men at the heart of the scheme.

Fallout: Internal Power Struggles and an Unresolved Scandal

The investigation exposed a fierce internal power struggle. The case was pursued aggressively by IRGC Counter-Intelligence against members of IRGC Intelligence. Notably, just three months after Hajipour’s arrest, the head of IRGC Intelligence, Hossein Taeb, was removed from his post and replaced by the head of Counter-Intelligence, Mohammad Kazemi.

While the interrogators who stole the money were arrested, their final sentences remain unclear, and the majority of the stolen funds have not been recovered. In a tragic twist, the original defendant, Sina Estavi, was sentenced in absentia to 15 years in prison. Having fled Iran, he remains a fugitive, while tens of thousands of investors still await compensation for a theft engineered by the state investigators supposedly meant to protect them.