1st July 2021

$3.6 Billion in Stolen Bitcoin — A Hack or Heist?

Two brothers, co-founders of a South African cryptocurrency investment platform, Africrypt, have been accused of running off with an estimated $3.6 billion worth of bitcoin from investors. It’s an allegation the founders “categorically” deny. Yet both they and the money are missing — and have been since April.

On April 13, right as bitcoin was hitting all-time highs of over $60,000, Africrypt investors received an email informing them that a hacker had gained access to company records and funds and that the company was trying to recover the funds. That was reportedly followed by a request: please don’t notify the authorities or lawyers. Not too long after, the two founders — Raees Cajee, 21, and Ameer Cajee, 18 — fled to the UK, purportedly with the stolen funds.

Hanekom Attorneys has been investigating the case and trying to trace the funds. But their efforts have been hampered because, as the law firm reported to Bloomberg, “the funds were put through a variety of tumblers and mixers, making them virtually untraceable.” The firm puts the estimated losses at $3.6 billion, although the Cajee brothers dispute that number. Speaking from an undisclosed location, Raees Cajee said that was impossible, given that Africrypt managed just over $200 million when bitcoin hit its all-time high. According to Raees, the missing bitcoin is valued at closer to $5 million. He also said he and his brother fled and hid because they had received death threats.

Even so, there’s unlikely to be an official investigation. Under South African law, crypto-assets don’t fall under the umbrella of financial products, so the country’s Finance Sector Conduct Authority can’t formally investigate the alleged scam. And if the bitcoin is never recovered, it’s more than likely that the investors will be left with no other recourse to recover their money.

The case highlights how vulnerable participants in unregulated sectors are and how easily crypto wealth can vanish. Those who transact in crypto already enjoy relative anonymity. It doesn’t take much to further exploit that to make funds disappear without a trace. And that there’s a lack of clarity around what legal tools are available to investigate and hold bad actors accountable makes crypto even more attractive as a way to steal and launder funds.

Countries and regulators are starting to take note, however. In 2019, FATF issued recommendations that place crypto and other virtual assets under the usual AML/CFT framework — something South Africa is currently considering — and countries are taking steps to regulate the space. Indeed, German regulators, for instance, just granted Coinbase, the largest cryptocurrency exchange in the US, a license to operate. It’s the first license issued under Germany’s new crypto custody regime and the first of its kind in Europe. But it certainly won’t be the last, and this may, in time, make what happened to Africrypt and Africrypt’s investors much less likely.