The arrest, the token transfers and what the record shows.
A source-led reconstruction of Iran International’s CryptoLand investigation, placed alongside Sina Estavi’s first-person account, visible evidentiary limits and later independent context.
Published: 23 July 2026Last reviewed: 23 July 2026
Watch the report first. Then follow the evidence, section by section.
Mojtaba Pourmohsen’s video includes images of documents and transactions together with portions of the reported video and audio record. The Persian article is the fullest published written account.
Primary data, a reviewable number or a transparent method.
02INVESTIGATIVE REPORTING
A finding attributed to the outlet and the material it says it reviewed.
03ESTAVI’S ACCOUNT
Personal experience or interpretation identified as first-person account.
04INDEPENDENT CONTEXT
Later reporting that adds context without proving causation.
01
READING NOTE
PUBLIC RECORD
A public record, with visible boundaries.
This page reconstructs the reported evidence without pretending that every disputed point has been independently adjudicated.
The principal source is Iran International’s March 2025 investigation. The outlet says it reviewed exclusive court material, a court-appointed expert report, blockchain records, videos and approximately three hours of court audio. Its Persian report is materially more detailed than the English edition, so both versions are linked throughout this record.
Claims directly described in that investigation are attributed to Iran International. Personal experience is identified as Sina Estavi’s account. Later reporting about Iran’s crypto infrastructure is presented as context, not as proof of a causal connection to the 2021 CryptoLand case.
BRG was not an obscure token at the moment the system stopped.
KuCoin’s official listing announcement recorded BRG trading pairs against USDT and Bitcoin and a market capitalisation of approximately $602.2 million on 20 February 2021. This is a contemporaneous exchange record, not a valuation reconstructed years later.
The first-tweet NFT acquisition in March 2021 brought Estavi and the Bridge name global attention. Estavi’s position is that the damage that followed was therefore not limited to tokens or cash: it affected trust in his name, CryptoLand and BRG at a moment of unusual international visibility.
01
$602.2m market capitalisation recorded by KuCoin on 20 February 2021
02
BRG/USDT and BRG/BTC trading announced for 24 February 2021
03
The NFT associated with the first tweet was acquired for about $2.9m in March 2021
The arrest, the announcement and the collapse in confidence.
Iran International reported that Estavi had no private complainants when detained; complaints followed the shutdown and the public announcement.
Iran International reported that Estavi was detained on 17 May 2021 and taken to Ward 2A of Evin prison. The arrest was then announced from his own X account by an IRGC-linked cyber unit. The outlet reported that specialist crypto media repeated the news and that buyers began to panic.
The investigation says questioning also focused on Estavi’s past support for Mahmoud Ahmadinejad and attempts to connect him to Israel. Estavi told the outlet that he had once given Ahmadinejad at least $3,000 and promoted him through Telegram channels before an election. Iran International presents those exchanges as part of the political context surrounding the detention, not as proof of a crypto-related financial offence.
The Persian investigation places BRG at about $0.12 immediately before the arrest and around $0.01 five days later. That fall does not by itself prove who caused every trade, but it documents the market shock against which the later token sales occurred.
Estavi describes the reputational impact in direct terms: the same event that removed his control over the business also made him the public face of obligations he says he could no longer access the systems or funds to resolve.
What the reported blockchain and court record says moved.
The strongest documented number is above $21 million — not an unsupported round figure.
Iran International reproduced a TronScan record showing six billion BRG transferred at 12:46:03 UTC on 18 May 2021, one day after Estavi’s detention, from a wallet the outlet identifies as his. It said a court-appointed expert later confirmed that 2,410,700,000 BRG were sold.
The report says that after approximately one month in detention and a dry hunger strike, Estavi obtained limited access and stopped further transfers. It later describes a guarded return to part of the CryptoLand office on 10 November 2021 so the platform could reopen for repayments, followed by release on bail reportedly set at 136 billion toman in early 2022.
Using the lower post-arrest market price, the investigation estimated those confirmed sales at more than $21.7 million. At the pre-arrest quoted price of $0.12, the same number of tokens had a notional value of about $289 million. That second figure is useful for understanding the destruction in quoted value, but it is not evidence that $289 million in cash could have been realised without liquidity limits and slippage.
This is why this record does not state that “$300 million was sold.” It states the documented sale estimate and separately explains the pre-arrest notional value.
01
6bn BRG reported moved after detention
02
2.4107bn BRG sales confirmed in the reported expert analysis
03
More than $21.7m estimated at the lower post-arrest price
The false buyer, the controlled meeting and the wallets on the phone.
The reported sting operation is the point where the story moves from allegation to described physical evidence.
Nineteen days after Estavi’s release, a contact using the names Shahrokh, Mohammad and Murad approached him with an offer to sell back billions of BRG supposedly held by a Turkish third party. Messages published by Iran International show an offer to make a small proof transaction. The outlet reported that the contact was Behnam Hajipour, a senior IRGC intelligence officer, and concluded that the alleged Turkish owner was a fabricated identity.
Iran International says Hajipour later claimed in court that he had bought the tokens for 250,000 USDT. The report also describes footage it says was recorded from inside an IRGC intelligence building and negotiations that moved from roughly $3 million toward $1.5 million. These are reported statements and recordings; this page does not treat the claimed purchase as an independently verified transaction.
According to the investigation, Estavi recorded calls, verified an IRGC personnel code and took the material to IRGC counterintelligence. An initial meeting was held at Ten Forever restaurant in Tehran’s Roma Center. For the controlled meeting on 15 March 2022 at Al Rayan restaurant in Niavaran, the report says Estavi carried a hidden camera in a power bank, wore a microphone and handed over $10,000 in marked currency. After receiving access to the private keys, he used the prearranged phrase “strawberry juice” and officers entered.
Iran International says the court expert’s report recorded two BRG wallets on Hajipour’s phone containing 3,742,100,000 tokens and described the wallets as his. The same report, according to the outlet, documented the earlier sales transaction by transaction.
01
$10,000 in recorded sting-operation funds
02
3.7421bn BRG reportedly found in two wallets on Hajipour’s phone
03
The claimed Turkish owner described as a fabricated identity
The reported network was larger than one interrogator.
Iran International connected Hajipour to a wider network through the court material it reviewed.
The outlet reported that Hajipour’s recorded assets rose from roughly one billion toman before the reported theft to about 60 billion toman within four months. It identified Mehdi Badi, also known as Dr Ebadi, as a second senior interrogator and said the material named additional officers and document forgers.
The asset list described in the published court excerpts included property, domestic and imported cars, land, approximately 1.099 kilograms of gold and jewellery, and investments in two Al Rayan restaurant branches. In audio aired by Iran International, an investigator appears to acknowledge Hajipour’s security role and questions the purchase of stolen BRG. The hearing refers to 60 billion toman—far below the investigation’s separate 616-billion-toman estimate of the token sales—so this page keeps the two figures distinct.
Iran International further reported allegations in the same court material involving Badi and a wider network: $400,000 plus €60,000 allegedly received from Rasoul Danialzadeh, 2.5 billion toman allegedly connected to Esmail Khalilzadeh, and $47,000 plus €48,000 allegedly paid by Hadi Darvishvand to Badi and his team. These remain allegations attributed to the documents and investigation; the article says the final fate or sentences of most defendants are not publicly available.
The English report says the fate or sentences of most defendants remain unavailable, except that Hajipour’s appeal was rejected in September 2022. The lack of a complete public court archive is an important limitation: this page does not fill that gap with speculation.
Financial loss can be counted. The destruction of continuity, trust and a public identity is harder to measure.
Iran International reported more than 51,000 private complainants after the shutdown. It said approximately $14 million was paid to about half of the affected users from Estavi’s account while he was detained, leaving roughly 25,000 people still owed money.
The outlet also reports that Estavi received a 15-year sentence together with restitution obligations and later left Iran. This page records that outcome neutrally while separating it from the different, partially unavailable court outcomes concerning the alleged IRGC network.
Estavi’s account is that the seizure and shutdown removed the people, systems, devices and funds needed to respond, while the public narrative continued to assign the resulting failure to him. He argues that the arrest, announcement and token sales damaged his reputation, the CryptoLand brand and the global confidence BRG had accumulated.
Estavi further describes CryptoLand at that time as Iran’s leading crypto exchange and says Nobitex was not regarded as a comparable competitor. No independently audited historical market-share dataset reviewed for this page establishes that ranking, so it is published as his account rather than as a verified league table.
No independent damages study reviewed for this page assigns a dollar value to that reputational harm. It is therefore presented as Estavi’s argument, supported by the documented timing of the arrest, market collapse and sales — not as an audited damages figure.
What later Nobitex reporting proves — and what it does not.
The later evidence is significant context about Iran’s crypto system. It is not proof that Nobitex directed the 2021 action against CryptoLand.
Reuters reported in June 2025 that an attack on Nobitex destroyed about $90 million. The attackers accused the exchange of helping the Iranian state evade sanctions; blockchain firms separately documented flows involving IRGC-affiliated ransomware actors and other sanctioned networks. Nobitex acknowledged unauthorised access to its systems.
A May 2026 Reuters investigation reported that brothers Ali and Mohammad Kharrazi, using the surname Aghamir, founded and control Nobitex, with Amir Hossein Rad as a co-founder and public executive. Reuters traced substantial state- and IRGC-linked flows through the exchange. Nobitex denied direct government ties and said illicit transfers occurred without management knowledge or approval.
In June 2026, the U.S. Treasury designated Nobitex for materially supporting the IRGC. That official action strengthens the evidence of a later operational relationship between IRGC-linked funds and the exchange. It still does not establish that Nobitex requested, participated in or benefited from the 2021 action against CryptoLand.
01
Later IRGC-linked flows: documented
02
Nobitex ownership by the IRGC: not established by the reviewed sources
03
A causal link to the CryptoLand case: not established
To respect copyright and avoid republishing personal identifiers, Iran International’s screenshots are not copied here. This index tells readers exactly what to look for in the source report.
Reputation is not rebuilt by making the claim larger. It is rebuilt by making the evidence, source and limits unmistakably clear.
If further publishable evidence becomes available, this page will be updated with a clear date and provenance. Claims about CZ interactions, a planned Binance listing or a direct Nobitex role in the 2021 case will not be presented here as fact without screenshots, archives or independent documentation.