Israeli prosecutors on Friday indicted Eli Lavon, a 21-year-old US citizen, for allegedly spying on behalf of Iranian intelligence in exchange for roughly $1,379 in crypto. The case shows Iran’s alleged crypto recruitment playbook maturing into gig work for espionage.

Lavon is reportedly the first American indicted in Israel’s spy wave, which counts at least 60 defendants since 2023. In many cases, small payments rather than ideology appear to drive recruits.

A Job Ad, Three Phones, and $1,379

According to the indictment, Lavon answered a Telegram job advertisement in November 2025 while visiting family in the US. A handler working for Iranian intelligence began assigning tasks once he returned to Israel.

He allegedly filmed an abandoned building and a grocery store in Jerusalem. He also left dead drops, including a USB drive wrapped in a 50 shekel note.

The crypto arrived in small batches, first hundreds of dollars, then about $518 from a second handler. The output had real military value, however. Several sites filmed by alleged recruits in this wave were later struck by Iranian missiles.

Arrested on June 9, Lavon faces two counts of contact with a foreign agent and 14 counts of communicating information to the enemy.

“This indictment illustrates how foreign intelligence agencies attempt to exploit the digital sphere to identify, recruit, and operate individuals from within Israel…” Ronit Shentzer Yaakobi of the Jerusalem District Attorney’s Office said in a statement.

Follow us on X to get the latest news as it happens

Crypto Recruitment Moves From Spying to Sabotage

The playbook no longer stops at surveillance. HAYI, a group that surfaced online in March, has claimed 17 arson and sabotage incidents across seven European countries. Analysis suggests it may be a “fabricated front” run by Iran-linked operatives using paid, disposable recruits.

British police have detained at least 28 people over the London attacks alone. A Belgian teenager was reportedly paid to stage an Antwerp arson later claimed by HAYI. Another teen charged over a London synagogue fire told investigators he did not know what the building was.

Each element mirrors gig work. Tasks arrive through consumer apps, payment clears per job, and recruits stay ignorant of the wider operation. Researchers describe the tactic as hybrid warfare because paid intermediaries blur any link to state planners.

The economic factors set this model apart from traditional terrorism financing. When OFAC sanctioned 134 ISIS-K wallets on July 1, analysts traced roughly $1.4 million into them since 2023. Lavon’s alleged payroll was about a thousandth of that, and Tether still froze 131 sanctioned wallets within a day.

Large networks, in other words, have become visible. Courts have secured terrorism financing convictions on onchain records, and probes into Iran-linked crypto networks chased billion-dollar flows.

A $500 gig payout offers far less signal, a gap that US lawmakers have barely addressed in their debate on illicit finance loopholes.

Whether blockchain surveillance built for large transfers can adapt to micro-payments may decide how quickly such networks unravel.

Source: BeInCrypto