Iran's Crypto Gig Economy Pays $1,379 for Espionage, 0.0001% of a Sanctioned ISIS Wallet 🧅

An American citizen studying at an ultra-Orthodox seminary in Jerusalem has been indicted on espionage charges, becoming the first U.S. national prosecuted in Israel's widening crackdown on Iranians recruited to spy for cryptocurrency payments. Eli Lavon, 21, was formally charged Friday with two counts of contact with a foreign agent and 14 counts of communicating information that could benefit an enemy, according to an indictment filed by the State Attorney's Office and reported by CNN. Prosecutors allege the case began in November 2025, when Lavon responded to a job posting on the Telegram messaging app while visiting relatives in the United States, and was subsequently contacted by someone claiming to represent Iranian intelligence as he returned to Israel a month later.

According to the indictment, Lavon was directed to film an abandoned building in a religious Jerusalem neighborhood and record footage inside a grocery store, communicating through two Telegram accounts and three phones. In one instance, he was told to conceal a cigarette pack containing a note reading "The job is complete" in a trash can at a Jerusalem shopping mall. Prosecutors say he was paid in cryptocurrency for the material he provided, with payments arriving first from one handler, then a second, who pressed him for names of fellow seminary students, which Lavon declined to provide. He allegedly hid a flash drive wrapped in currency at a restaurant and sent a photo of his passport. His combined payments from both handlers totaled roughly $1,379, prosecutors said.

Lavon's attorney, Raz Bar Tzvi, told CNN that being contacted online by a foreign actor does not make someone a spy and argued the facts described in the indictment do not support the charges. He declined to say how his client would plead. Ronit Shentzer Yaentzer Yaakobi of the Jerusalem District Attorney's Office said in a statement, "This indictment illustrates how foreign intelligence agencies attempt to exploit the digital sphere to identify, recruit, and operate individuals from within Israel, and how important it is to remain vigilant and immediately sever contact when approached in this manner." Israel has indicted roughly 60 people on Iran-related espionage charges since 2023, and officials say several sites allegedly surveilled by such recruits were later struck in Iranian missile attacks.

The alleged crypto recruitment model mirrors patterns that have surfaced across Europe. A group calling itself HAYI, which surfaced online in March, has claimed responsibility for 17 arson and sabotage incidents across seven European countries, and analysis suggests it may be a fabricated front run by Iran-linked operatives using paid, disposable recruits. British police have detained at least 28 people over London attacks alone, and a Belgian teenager was reportedly paid to stage an Antwerp arson later claimed by HAYI. Separately, two Israelis have been charged with using classified information to make bets about the nation's military operations on Polymarket, with prosecutors alleging an IDF reservist accessed classified information about Israel's planned attack on Iran in June 2025 and shared it with a civilian who placed multiple bets.

The economic scale of these small payments remains marginal compared to larger sanctioned networks. Lavon's alleged payroll of about $1,379 is roughly a thousandth of the $1.4 million traced into 134 ISIS-K wallets sanctioned by OFAC on July 1. Tether froze 131 sanctioned wallets within a day of that action, and courts have secured terrorism financing convictions using onchain records. Lavon was arrested on June 9 and remains in Israeli custody pending further proceedings.