Two South African brothers are facing mounting pressure to come forward to authorities as investigators delve into one of the biggest cryptocurrency thefts in the country.

Raees and Ameer Cajee are central figures in the now infamous Africrypt cryptocurrency investment scheme saga. Local investors have been left in the dark and out of pocket following what the Cajee brothers claimed was a hacking incident that saw the company’s cryptocurrency holdings stolen.

The brothers headed up the purported investment firm which promised lucrative returns on investments, as per its 2020 investment presentation. Clients could either make South African rand or Bitcoin 

BTC

$21,291

 deposits to Africrypt, which then managed those investments.

Things fell apart in April 2021 after Raees Cajee informed investors through a letter that hackers had allegedly stolen an unconfirmed amount of its holdings. Shortly after the Cajees had pleaded with clients not to opt for legal proceedings, the Africrypt website went offline.

There are conflicting reports around the actual value of cryptocurrency that was managed by Africrypt — but a June 2021 report by the Wall Street Journal quoted the eldest brother’s estimate that Africrypt was managing around $200 million worth of cryptocurrency at the height of the market’s 2021 boom.

Investors have sought legal counsel in order to wrestle back their funds from Africrypt, while financial regulators have been hamstrung by current regulations of cryptocurrencies in South Africa, which leaves the space out of their jurisdiction.

It’s important to note that the Africrypt saga is not the first time that the Cajee brothers' businesses have fallen prey to alleged hacking incidents. Back in 2019, RaeCreate Wealth, which is incorporated in Hong Kong and ran by Cajees’ informed investors, had some of its cryptocurrency stolen during a Binance hack. It is unclear whether investors were ever reimbursed for their losses as the Cajees registered Africrypt in the same year, according to the company’s registration documentation verified by Cointelegraph.

The Cajee brothers disappear

The exact whereabouts of the Cajee brothers are still unknown, and the pair have previously claimed their flight from South Africa was necessitated by subsequent threats from a number of disgruntled clients that have banded together to seek legal recourse.

Local company Badaspex (Pty) Ltd. is spearheading its own legal effort to recoup funds invested in Africrypt. The company launched an application on April 19, seeking for Africrypt to be liquidated following the scheme’s claims that it had lost investors’ holdings.

Cointelegraph contacted Johannesburg-based attorney Gerhard Botha who is representing Badaspex, as well as other investors that lost funds to Africrypt. Botha confirmed that Badaspex is looking to recover $2.4 million (35 million rands) invested in Africrypt, a figure that has not accounted for the appreciation in value of the BTC that was entrusted to the Cajee brothers’ firm. The attorney is representing a total of 105 investors, whose lost investments amount to what he described as a “conservative” $8 million (115 million rands).

The attorney also refuted the Cajees’ claim in the WSJ in June that Badaspex’s director Juan Meyer, a figure once linked to locally convicted Czech gangster Radovan Krejcir, had threatened them after Africrypt shuttered.

Meyer’s attorney said his client had tried to meet with one of the brothers at a hotel in Johannesburg to discuss Africrypt’s closure. After agreeing to meet, Meyer was left waiting at reception for about 15 minutes before the hotel’s security requested him to vacate the premises. Botha told Cointelegraph that the version of events put forward by the Cajees was “opportunistic,” given that the incident was clearly set out in the court-order application:

“The version that the Cajees put forward is unfortunate because the visitation of Mr. Meyer was recorded in the court application. [...] There was no physical interaction between the two. The Cajee brothers were allowed to answer that version in court and they’ve elected not to.”

The Cajee brothers employed the legal services of Johannesburg-based attorney John Oosthuizen soon after the hacking incident was claimed to have taken place. Oosthuizen had made several comments to the media before announcing that he was no longer representing the brothers or Africrypt in late June 2021. Africrypt has until July 19 to make a case against the Badaspex liquidation order application.

A separate source undertaking a private investigation into the Africrypt debacle told Cointelegraph that it was aware that 35 separate criminal cases have been opened, seeking around $3.2 million (46 million rands) invested in the scheme.

Bank documents seen by Cointelegraph show that more than $7 million (100 million rands) passed through the Cajees’ local business bank account — a point of contention that has been denied by First National Bank.

It is understood that the brothers left South Africa in December 2020 and have been traced to different hotels in the United Arab Emirates.

Africrypt not under South Africa’s FSCA jurisdiction

This type of financial fraud would usually fall under the jurisdiction of the South African Financial Sector Conduct Authority (FSCA). Cointelegraph reached out to the regulatory body to ascertain whether it is actively involved in ongoing investigations into the Africrypt case.

The FSCA replied with a public statement it had released acknowledging complaints received against Africrypt and was investigating whether the firm had actually offered a financial product or service to the public. This is a crucial aspect, as it would have required Africrypt to have registered with the regulator, which it has not. The FSCA statement read:

“At this stage, we have only found evidence of crypto-asset transactions. Currently, crypto assets are not regulated in terms of any financial sector law in South Africa and consequently, the FSCA is not in a position to take any regulatory action.”

While the FSCA is not in a position to impose any sanctions on the company, it did state that its own investigations into the firm suggest that it was operating a dubious investment scheme: “This entity was offering exceptionally high and unrealistic returns akin to those offered by unlawful investment schemes, commonly known as Ponzis.”

In another local report, Raees Cajee claimed that Africrypt had been registered with the Financial Intelligence Centre (FIC) and that the company had abided by necessary Anti-Money Laundering (AML) controls. Cointelegraph has reached out to the FIC to ascertain whether Africrypt was registered with the center, but has not received a reply at the time of publication.

Clients used the local exchange to send crypto to Africrypt

Information provided to Cointelegraph by private investigators allowed for some basic blockchain analysis of transactions sent to and from Bitcoin addresses provided to Africrypt clients over the past few months.

Some clients’ wallets received BTC from an original wallet that has received more than 689,000 BTC, worth around $22 billion, since November 2020. Cointelegraph has ascertained that this is the hot wallet belonging to prominent South African cryptocurrency exchange Luno.

International blockchain analytics firm CipherTrace assisted in this regard but noted that the exchange was likely to have only been used to handle Africrypt customers’ deposits and not to accumulate holdings. The CipherTrace spokesperson told Cointelegraph:

“It is certainly possible that some of the Africrypt funds were either deposited to or sent to this exchange, which could be an indicator that Africrypt was not a standalone ‘exchange,’ but actually more of a high-yield investment program.”

Luno Africa’s general manager, Marius Reitz, told Cointelegraph that Africrypt does not hold a Luno account and that there is no relationship between either company: “Although Africrypt began the process of applying for a Luno account in 2019, the process was never completed and therefore the business account was never opened.”

Reitz added that Luno did not receive any customer queries in relation to Africrypt prior to news reports of the company’s collapse. He added that Africrypt had not been flagged by any of the blockchain analytics companies that focus on detecting and preventing the use of cryptocurrencies in illicit activities. Nevertheless, the exchange is involved in ongoing investigations:

“Luno has engaged and continues to work with authorities and interested parties. Our preliminary investigations indicate that the amount claimed appears to be grossly overstated. In addition, the overwhelming majority of known related companies and associates provided to us did not hold Luno accounts.”

Private investigators also told Cointelegraph that some BTC was allegedly moved to VALR, another popular South African cryptocurrency exchange, after blockchain analysis was carried out on another Africrypt client's Bitcoin wallet address.

VALR CEO and co-founder Farzam Ehsani told Cointelegraph that they could not share any information on its users, while adding that it was registered with the FIC and did what it could to prevent illicit activity through its platform: “VALR is registered with the Financial Intelligence Centre and we engage with the regulators on a regular basis to combat any activity by any actor that seeks to abuse our industry or cause harm to others.”

Africrypt’s theft amount “grossly overstated”

Initial media reports on the Africrypt saga pinned astronomically high values to the amount of assets under the company’s management. Figures as high as $3.6 billion had originally been touted — numbers that Reitz believes are improbable:

“At present, it appears that the amount of almost 70,000 BTC claimed to have been moved is grossly overstated. The movement of such a large amount of BTC would have raised several red flags for exchanges and blockchain analytics companies, particularly given the claim that it was moved in the space of a few hours.”

Reitz also noted that the accuracy of the reported scale of the Africrypt scheme is an important consideration. The sheer scale of the initial amounts reported would simply be unable to be moved or mixed without affecting cryptocurrency markets or being flagged by analytic firms.

Reitz further said that following the collapse of Mirror Trading International in 2020, this latest incident serves as an important reminder to investors to do their homework when entrusting assets to third parties:

“Any guarantee of earnings should be viewed with suspicion, as returns cannot be guaranteed when it comes to cryptocurrencies. Many financial fraud schemes talk about ‘bots’ that trade on your behalf and present fake testimonials as proof of guaranteed or outsized returns. If something sounds too good to be true, it probably is.”