Proudly sponsored by

Meet the 29-year-old South African unravelling the multi-billion-rand Africrypt theft

Hamilton Cheong, who grew up in the Magaliesberg, is helping law enforcement authorities in several jurisdictions uncover where the money went.
Cheong’s company helps governments and organisations secure their digital assets against threats coming from ransomware and organised crime. Image: Supplied

Read the latest on this story: Christmas payout of 65c in the rand for Africrypt investors

There are several aspects to the Africrypt ‘hack’ – reckoned to have lost R43 billion – that have caught the attention of law enforcement authorities across the globe.

The first is the size of the reported theft at $2.9 billion or about R43 billion. It’s a figure so eye-poppingly huge that many have questioned whether this volume of money could have come out of SA.

The other aspect of the theft that has law enforcement on high alert is whether this was the result of a hack – as claimed by Raees and Ameer Cajee, the two brothers behind Africrypt – or whether it was an inside job. The Cajees fled South Africa, apparently in fear of their lives after receiving death threats immediately after the alleged hack.

Read: Trail of brothers linked to missing bitcoin stash is still murky
Africrypt’s Raees Cajee comes out of hiding in Tanzania to oppose liquidation

The man who has a better understanding than most of what happened is Hamilton Cheong, a South African-born forensic sleuth now based in the US, who has spent the last few weeks assisting law enforcement agencies around the world to unpack what happened with the Africrypt billions.

Blockchain track-and-trace

Cheong’s company, Crypto Investigation Bureau (CIB), helps governments and organisations secure their digital assets against modern-day threats coming from ransomware and organised crime.

It has developed a blockchain track-and-trace programme called God’s View to hunt down missing digital assets, and it was this programme that was used to piece together the movement of funds into and out of Africrypt wallets.

The blockchain is a detailed and immutable ledger of all bitcoin transactions, and is open to public scrutiny. The problem is linking bitcoin addresses with real-world people and organisations, though that is becoming easier through the use of software tools like God’s View, which made it possible to track every bitcoin moving into and out of Africrypt-controlled wallets.

‘Hack’ story

Cheong says the evidence does not support the story of a hack originating out of Ukraine, as claimed by Raees Cajee in an affidavit before the Gauteng High Court seeking to stop the final liquidation of Africrypt.

Under Cajee’s version of events, on April 13 hackers from Ukraine smashed through several layers of security to make off with more than R50 billion in crypto assets.

“We don’t think this is possible,” says Cheong, a certified crypto and blockchain investigator.

“If this is true, the hackers would have broken through several security layers in a matter of minutes to get to the crypto, and that is extremely unlikely. We don’t think this was a hack. One reason we say this is that four months before the alleged hack, funds were being depleted out of wallets under the control of Africrypt.”

Millions or billions lost?

Raees Cajee claims in his affidavit that the extent of funds under Africrypt control was closer to $6 million (R88.5 million) than the R54 billion claimed by attorney Darren Hanekom of Hanekom Attorneys, who is representing several Africrypt clients.

Even that low figure of $6 million is disputed, as claims totalling around R200 million in SA have mounted against Africrypt.

Cheong says Hanekom’s claim of R43 billion is closer to the truth, and hints that the actual figure could be higher – much higher – once all the wallets used by Africrypt are totalled together.

By painstakingly piecing together the web of transactions into and out of wallets used by Africrypt, Cheong hints that some of these wallets are used by operators known for ransomware attacks on business and by ‘dark web’ operatives.

“I don’t buy the hack story, and I think the Cajees were in over their heads and perhaps got mixed up with some really bad people,” says Cheong.

A better picture of what occurred awaits the release of a full forensic report by Cheong’s team.

Disturbing tie-ins

Astonishingly, he says there are some disturbing tie-ins between Africrypt and Mirror Trading International (MTI), the crypto scam headed by CEO Johann Steynberg that roped in more than 23 000 bitcoin from hundreds of thousands of investors around the world.

MTI is currently in provisional liquidation, and Steynberg remains at large, having gone awol in December 2020 when MTI members’ requests for withdrawals went unanswered.

Some of the same ‘tumblers’ used by Africrypt were also used by MTI, says Cheong.

Tumblers are used by money launderers to hide the origin of funds by effectively creating an omelette out of several bitcoin eggs. Bitcoin from several sources are mixed and broken up in these tumblers and then shipped out, usually in small quantities, to cover the tracks of the money launderers.

Cheong dedicated hundreds of hours of his own and his team’s time to unravelling the Africrypt web because he had the resources and tools to do it. He also has a deep sense of patriotism.

Africa is home, he says, but SA is earning a reputation internationally as a haven for dodgy crypto ventures.

MTI was rated by Chainalysis as the world’s biggest crypto scam of 2020, but it pales alongside what appears to have been stolen out of Africrypt-linked wallets.

Read: MTI was by far 2020’s biggest investment scam – Chainalysis

Says Cheong: “We must assume the Cajee brothers are innocent until proven guilty.

“My question to them is why have they not commissioned an incident report by professionals to clear [their] names, instead of running?

“If they are willing to provide CIB with their full app and source code, we would love to help,” he adds.

A long way from home

Cheong says he grew up in a troubled family and ended up homeless in SA for extended periods. He was passed between different households but while working at a scrapyard discovered a talent for fixing broken computers.

Forced out of necessity into entrepreneurship, he sold reconfigured computers at flea markets over weekends, and left for Israel in 2014 where he gained hands-on experience in some of the biggest tech businesses in the world.

That experience also drew him into coding and financial markets. In 2016, he created an electronic wallet for the secure storage of digital assets, and that brought him to the attention of Canadian investors who helped fund the early-stage launch of the product, called Just Wallet.

“We’re trying to replace Swift as the global system for payments,” says Cheong.

Ironically, he believes cryptos are a scam, in large measure because the boast of decentralised control is already subverted by the centralisation of control of parts of the crypto value chain in certain hands.

“We have ransomware attacks occurring on a daily basis and no one has really come up with a firewall against that.

“This is what we decided to do. You’ve got huge volumes of wealth being transmitted electronically and far too many weak points in the chain.”

When the Africrypt story is finally told, Cheong’s name will feature strongly in the credits.

Moneyweb reached out to Raees Cajee by phone without success.

Read: Lightning strikes twice for Africrypt’s Cajee brothers



Sort by:
  • Oldest first
  • Newest first
  • Top voted

You must be signed in and an Insider Gold subscriber to comment.


The intangibility of Bitcoin, by it’s nature, will attract the good and certainly the bad element who are out to scam and steal, and it seems this is being perfected to such an art we can scarcely explain what has just happened.

Unlike conventional currencies that are totally tangible and simply are never laundered. Right.

Unlike conventional currencies that are totally tangible and simply are never laundered. Right.

No, not at all, bitcoin by nature is anti-criminal, why? it is public. It is the same as having your bank account balance available to anybody in the world. Anybody anywhere can see and trace (to a point ) the crypto.

They are typical S.A. criminals, al state capture and digital vibes. If they had and sense of what they were doing they would have used privacy crypto like Monero.

Whats the old saying”You need to be a criminal to catch a criminal”

Would you be man enough to say that to his face I wonder?

Would you be man enough to say that to his face I wonder?

Like you need to be a disease to cure one.

What an utterly dumb statement.

I dont think this is true the 29 jr old S.A. guy tracing the funds is not a criminal. However ironically a South African!

Oh the irony the guy helping the FBI is South African! Eish what a world.

Again: crime is built into the very fabric of crypto. It has two elements criminals love, which are anonymity and no regulatory oversight. Yes; ordinary bank clients fall prey to scammers too, but here we have the equivalent of the directors of one of the Big 5 banks in SA scarpering with all their clients’ deposits.

This of course happened at VBS, but when this does happen, there is a lender of last resort, the Reserve Bank, which guaranteed depositors’ money. This backup is completely missing with crypto – you’re on your own if you gamble with crypto and get ripped off.

Stay far, far away from crypto, unless you like making criminals rich with your children’s inheritance.

At some point the crypto needs to be converted to real money if it is to be of any use, so KYC will catch these criminals at that point as there is a trail in the blockchain ledger. It is not as anonymous as people think.

Pay for things with crypto directly.
Buy other tokens on marketplaces and get the proceeds in a new wallet.
Stake it on the defi exchanges and just spend the new earned tokens.

Er sorry, it’s not anonymous. And if I stayed away from crypto, I would’nt be heading for an early retirement.

Could it be that lots of it is anc loot? Maybe the reason why “clients” are not very vocal.

I would like to see a list of the “clients”. It would be very interesting.

You heard it boys and girls, Cryptos are a scam! Stay away

it is definitely not a investment instrument!

If I listened to you I would’nt be on my way to early retirement had it not been for approach to crypto with some due diligence and common sense instead of all the fools who get taken for a ride because they got no clue what they doing, as with all investments. Lesson one, don’t put your money into things you don’t understand. If you want to, go burn the midnight oil first.

When this all goes quiet then you know he has got close to a cadre…..

Just like the Dirty Dozen that the hat told us about, they got to number 5 and suddenly all quiet……..

see if his services can be obtained for the hijacked / paralyzed Durban harbour services

seems to me there was never a decent backup / recovering system / security system in place made by however is running their software or it devision


Never use that word in the same sentence as one describing anything to do with an SOE.

The FBI managed to track and reverse a few million dollars of Bitcoin paid for ransomware. When you have the budget, skills and might on the scale of the US Government – nothing stays anonymous for ever. Given enough time, the bitcoins will be traced. Whether they are returned to their rightfull owners is something completely different.

I call BS on this guy. On his LinkedIn profile he claims to speak 10 languages, ranging from Chinese to Northern Sotho to Dutch and he has a PhD from “Google and Youtube and Wikipedia”. Quite impressive for a 29 year old with a kid and a tattoo sleeve. I smell a rat.

yes, how did “law enforcement authorities in several jurisdictions” got hold of this sleuth?

They read The Hardy Boys.

why not just ask SARS?????????

These youngsters all aspire to be tony stark

From his website:

Hamilton Cheong. Founder, Serial Entrepreneur ,Productivity Hacker , Blockchain and Crypto Investigator and product architect and software engineer.He is the CEO, CTO, and chief Researcher of companies like Just Wallet™,Ransomware Security™,Crypto Education™ Institute, Public Ledger™, Follow meBelow.

Whoa whoa what is happening here? That number is absurd. Anyone in crypto with a brain knows that it is made up. Who is this Cheong? Iv never heard of him, there is no such thing as a “certfified blockchain detective”. How did that much money flow through FNB even AFTER thier crypto account crackdowns in 2019??? Where are the investors that lost all this money? FNB lawyers, I think its time your get involved now. @Ciaran Ryan Im not sure what you playing at, but on the surface this story looks to be complete fugazi

“Ironically, he believes cryptos are a scam..”

Thanks for confirmation of my initial opinion of cryptocurrencies by a global expert who has sadly relocated to countries where his expertise is rewarded and respected.

Bravo Mr Cheong on your hard graft and faith in your talents!

All power to Mr Smoothy-Pants from Magaliesberg. He’s doing nothing illegal. He’s obviously just a smooth BS operator, perfect for a fictional investment, where crypto, hackers, stupidity, greed and hubris meet. Clearly at 29 he’s the man for the moment. All these people deserve each other! A tulip for them all.

Dis baie snaaks, veral die tulip aan die einde!

This story is just loads of hogwash. Any foolish reporter can go on this bro’s linkedin and read the garbage in his profile. nee man, even a guy from the most ravaged hood in the cape flats can smell this horse manure a mile away. lol are humans that gullible?

Biiiig kudos to Hamilton! What he has achieved serves as the perfect example that anything is possible if you put your mind to it…Rising above his circumstances! I’ve been fortunate enough to see “god’s view” at work – mind blowing! Sad that you always have the negative, uninformed keyboard warriors commenting on things they don’t know anything about. Sad, but expected I suppose – which is sad!

Thanks Hamilton for your valuable input.

Why doesn’t Transnet use his services – or someone like him – to find out who and what was behind their IT hack that shut down all our major harbours for almost a week!!
Transnet is not nearly as transparent as Eskom when it comes to keeping clients, and the public, informed about what is being done to resolve very serious issues.
SA as a whole is going to pay the price; are we still the so-called Gateway to Africa after THIS?
More like the Fiasco of Africa!
This Crypto genius – or someone like him – is now needed for Transnet urgently!

What an amazing guy. God bless him.

End of comments.



Subscribe to our mailing list

* indicates required
Moneyweb newsletters

Instrument Details  

You do not have any portfolios, please create one here.
You do not have an alert portfolio, please create one here.

Follow us:

Search Articles:
Click a Company: