Iranian Intelligence Officials Embezzled Crypto During Fraud Probe

TLDR

• Senior IRGC intelligence officials stole $21 million in cryptocurrency while investigating Cryptoland
• Main suspects Mehdi Hajipour and Mehdi Badi sold seized BRG tokens for personal profit
• Hajipour’s wealth increased from $40,000 to $14.2 million within four months
• Cryptoland CEO Sina Estavi was sentenced to 15 years but fled the country
• Half of the 51,000 victims have been repaid, but 25,000 investors remain uncompensated

Iran’s Islamic Revolutionary Guard Corps (IRGC) is facing serious allegations of corruption after court documents revealed that senior officers stole approximately $21 million in cryptocurrency while pretending to investigate fraud. The case centers on Cryptoland, a digital exchange that was shut down in 2021.

The scheme began in May 2021 when Cryptoland CEO Sina Estavi was arrested on charges of “disrupting the economic system.” At the time of his arrest, Estavi had no formal accusers. The news of his detention soon spread, causing thousands of investors to file complaints.

Blockchain records show that just one day after Estavi’s arrest, six billion BRG tokens were moved from his crypto wallet. This transfer happened before the public was aware of any potential scandal. These tokens were later sold by IRGC officers for tens of millions of dollars.

Court documents identified two key figures in the operation: Mehdi Hajipour and Mehdi Badi. Both men were senior interrogators in the IRGC’s economic intelligence branch. A court-appointed expert confirmed that wallets controlled by Hajipour alone processed and sold over $21 million worth of BRG tokens.

The financial transformation of Hajipour was dramatic. Before the token theft, his assets were valued at approximately $40,000. Within just four months, his fortune had exploded to over $14.2 million (600 billion rials).

Hajipour spent his newly acquired wealth on gold, luxury real estate, and high-end vehicles. Court records detail these purchases as evidence of the sudden and unexplained increase in his personal wealth. This wealth disparity became a key point in the investigation.

Scheme Unravels

In March 2022, IRGC counterintelligence agents arrested Hajipour in a sting operation. He was caught accepting a $10,000 payment from Estavi. The CEO believed he was buying back stolen tokens from a third party, unaware this was a fake identity created by Hajipour himself.

After his arrest, Hajipour was held in Ward 66, a special prison facility reserved for IRGC personnel. His appeal was rejected in September 2022. The court documents do not provide complete information about the sentences for all defendants in the case.

The second main suspect, Mehdi Badi, operated under the alias “Dr. Ebadi.” His name has appeared in many major cases labeled as IRGC economic corruption investigations. Badi is reportedly the nephew of Ali Akbar Hosseini Mehrab, a former high-ranking IRGC official.

Court documents reveal that two other IRGC interrogators were also involved: Majid Jahan Parto and Majid Tabatabaei. Four additional people assisted the group by forging documents to legitimize the transactions. This network of corruption reached deep into the IRGC intelligence organization.

Three months after Hajipour’s arrest, there was a leadership change in the IRGC intelligence organization. Hossein Taeb was dismissed from his position as head and replaced by Mohammad Kazemi. The timing suggests possible connections to the scandal.

Estavi, meanwhile, was sentenced to 15 years in prison, 75 lashes, fines, and a lifetime ban from public service. He was ordered to return the embezzled funds. Despite a travel ban, Estavi managed to flee the country. A video later surfaced showing him in France.

Mizan news, a website controlled by Iran’s Judiciary department, reported that over 51,000 plaintiffs had filed complaints against Cryptoland. About half of these victims—whose losses amounted to $14 million—were repaid from Estavi’s account while he was in prison.

Around 25,000 other investors remain uncompensated. They are creditors of funds that were obtained and never returned by Hajipour, Badi, and other members of the network. With the main suspects in custody and the CEO fled, these investors face an uncertain future.

Estavi was known internationally for purchasing Twitter co-founder Jack Dorsey’s first tweet as an NFT for $2.9 million. This high-profile purchase brought attention to Cryptoland before its collapse, adding to the scale of the scandal when it unfolded.

The case is part of a broader pattern of crypto-related crime involving Iranian nationals. Earlier in March 2025, the U.S. Office of Foreign Assets Control sanctioned Behrouz Parsarad, an Iran-based operator of a darknet marketplace, for overseeing nearly $30 million in narcotics sales using cryptocurrency.