The Cajee brothers claim they were hacked

Raees Cajee has emerged from hiding in Tanzania to oppose the final liquidation of Africrypt, the bitcoin investment scheme that was allegedly hacked and emptied of R54-billion.

In his affidavit before the high court in Johannesburg, Cajee says nothing like R54-billion was hacked. It was closer to US$6-million (R88.5-million), and hackers from a Ukraine Internet address succeeded in making off with all the company’s crypto.

The affidavit was signed in Dar-es-Salaam in Tanzania on 19 July, putting paid to speculation as to his whereabouts.

Africrypt investor Juan Meyer of Badaspex was granted a provisional liquidation order in April this year after claiming an amount of nearly R67-million was owed to various clients. The case returns to the high court in September to decide whether or not final liquidation should be granted.

The application brought by Badaspex and the attendant media publicity resulted in the Cajee brothers and their family fleeing South Africa as they reportedly received numerous death threats, and an attempt was made in Dubai to kidnap their father.

Threatened

On or around 20 May, Raees’s father, Bilal Cajee, was apparently stopped by unknown Pakistani nationals in Dubai and the family threatened with harm unless a significant sum of money was paid to a nominated bank account. Bilal Cajee was then held in a hotel in Dubai for about 12 hours, during which time these threats were made.

This is now the subject of a criminal investigation in Dubai.

The kidnapping attempt was a case of “individuals having been contracted in Dubai by disgruntled investors who no doubt intended to intimidate and harass us into making unlawful payments,” deposes Cajee.

Raees Cajee is opposing the final liquidation, arguing that Badaspex had signed an agreement with RaeCreateWealth (RCW) in Hong Kong, and not with Africrypt, and therefore Badaspex had no contractual agreement with Africrypt. “The respondent (Africrypt) is not indebted to the applicant (Badaspex) as it contends or in any other amount whatsoever,” deposes Cajee.

He goes on to argue that there is no contractual relationship between Africrypt and either Meyer or Badaspex, based on the fact that Badaspex’s claim rests on an agreement that was partly oral and partly written.

The written part of this agreement was with RCW, which explicitly exonerates the company from any data breach (such as a hack) and requires any contractual disputes to be decided by the Hong Kong courts. This agreement was signed electronically by Raees Cajee on 26 October 2020, and then transmitted to Badaspex’s sole director, Adrian Pilling.

Any reliance by Badaspex on agreements purportedly made with the younger brother, Ameer Cajee, are invalid because Ameer was just 17 at the time.

Raees Cajee then goes on to argue that Meyer’s demand for repayment of money placed with Africrypt was precipitated by his questioning of Meyer’s source of funds. “I point out that I was uncomfortable dealing with Meyer as, by that stage, I had come across certain negative press reports concerning Meyer’s chequered past.”

He references a 2011 article from IOL headlined “Krejcir ex-partner wants millions back”, which claimed Meyer was a “colourful character who moves around town surrounded by a posse of bodyguards” and who was claiming R60-million from his former business partner, the now-jailed crime boss Radovan Krejcir.

‘Unreasonable demands’

Cajee wrote to Badaspex on 19 March, asking for information pertaining to the source of its funds in Africrypt, and it was this questioning that resulted in Badaspex “making unreasonable demands for repayment”.

Though RCW, in terms of the agreement signed by Meyer, was entitled to hold all the capital and profits for a period of 12 months, Cajee says he acceded to repay some of the invested capital out of fear for his safety. An amount of R2-million was repaid to Badaspex in February.

Cajee also asserts that Badaspex’s attorney, Gerhard Botha, conceded in an e-mail that the agreement was not between Africrypt and Badaspex, but between RCW and Badaspex.

The Badaspex funds were invested in RCWSA, a subsidiary of RCW. Cajee then discusses the volume of funds invested with Africrypt, which totalled around R200-million. “It is implausible to think that R200-million could have been turned into R51-billion between September 2020 and April 2021.”

Cajee then says Africrypt did not have an account with FNB into which Badaspex’s funds were received. Instead, the funds were received into RCWSA’s bank account, “and accordingly the applicant (Badaspex) has no claim against the respondent (Africrypt).”

However, Gerhard Botha, attorney for Badaspex, said: “We will be addressing these claims by Raees Cajee in our reply, but it is worth noting that several clients were repaid funds and made withdrawals at different times and that Africrypt, not RCWSA, was the company that clients were interacting with throughout.”

Darren Hanekom of Hanekom Attorneys, acting for a number of investors, disputes Cajee’s version of events on the basis that the bitcoin blockchain shows funds being shipped to a bitcoin address apparently controlled by the Cajees.

The following image shows just one of the addresses used by the Cajees, and an amount of 75 459 bitcoin, worth $2.4-billion (R36-billion) deposited into the address and subsequently withdrawn in 1 292 transactions. The address was still being used as of a week ago, when around 2.3 bitcoins were deposited and withdrawn.

Claims against Africrypt so far lodged total more than R200-million, says Hanekom.

“We are not saying R51-billion came out of South Africa and into Africrypt. What we are saying is that one of the bitcoin addresses used by Africrypt shows an amount of more than 75 000 bitcoin moving in and out, and that’s an amount of $2.4-billion. There were other addresses used by Africrypt.

“The Cajees have not explained where this additional bitcoin came from or what was the purpose of these addresses, and how come so much money was transacted through these addresses,” adds Hanekom.

“Clients stopped receiving statements in November 2020. On inspection of the provided addresses, it was observed that the client balances were transferred out and sent to the larger pooled account. This pooled address was flagged on the blockchain for links to malware and dark web marketplaces.”

Cajee denies Africrypt had any cryptocurrency wallets in its name, and also denies he and his brother fled the country with billions of rands in cryptocurrency owing to investors.

The “media attention and misinformation” around Africrypt and the fate of the missing money resulted in law firms demanding astronomically high fees. The Cajees cycled through two sets of attorneys before securing the services of Shaheed Dollie, a Johannesburg firm of attorneys.

“I further deny that Africrypt conducted a banking account at FNB and that it invested in cryptocurrencies such as bitcoin,” argues Cajee.

Hack

Badaspex brought the liquidation application after being informed of a hack on 13 April in which funds had been stolen. Cajee again leans on the agreement with RCW rather than Africrypt, and says RCW is not liable for any damages.

“However, with a view to being transparent, I point out that it was discovered by me on the morning of 13 April 2021 that the hot wallets (meaning an online wallet hosted on a server) and the private keys for the cryptocurrency assets as well as the API (application programming interface) keys and programming interface were inaccessible.

“After investigating the matter, it became apparent to me that the respondent (Africrypt, being the marketing, operations and administrative entity nominated by RCW) had lost access to its server. Later investigations revealed that these devices and information was accessed and unlawfully from a Ukrainian IP address, which information was disclosed to me by the respondent’s external service provider. It is thus clear to me that the information was unlawfully obtained and used for the benefit of individuals who had criminal intent.”

The result of this was that personal information belonging to clients such as ID documents, proof of residence, confidential banking information and other information was lost “without any prospect of any recovery”.

RCWSA is under no obligation to repay any investments made. “Indeed, these were not loans made in the ordinary course of business and it is in the nature of investments that they can be lost.”