TheBitfinexcryptocurrency exchange was hacked in August 2016.[1] 119,756bitcoins, worth aboutUS$72 million at the time, were stolen.[1]
In February 2022, the US government recovered and seized a portion of the stolen bitcoin, then worthUS$3.6 billion,[2] by decrypting a file owned by Ilya Lichtenstein (born 1989) that containedaddresses and private keys associated with the stolen funds.[3] Lichtenstein and his wife, Heather R. Morgan (born 1991), were charged with conspiracy tolaunder the stolen bitcoin.[3] In August 2023, Lichtenstein admitted to committing the theft. Both Lichtenstein and Morgan pleaded guilty to money laundering.[4]
In November 2024, Lichtenstein was sentenced to five years in a US prison for his involvement in money laundering the stolen bitcoin.[5] Morgan was sentenced to 18 months in prison for fraud and conspiracy charges.[6]
In August 2016, theBitfinexcryptocurrency exchange, based inHong Kong, announced it had suffered a security breach.[7] Around 2,000 approved transactions were sent to a singlewallet from users' segregated wallets.[8][9] Immediately thereafter,bitcoin's trading price plunged by 20%, causing the value of the stolen bitcoins to dip toUS$58 million.[1] After learning of the breach, Bitfinex halted all bitcoin withdrawals and trading[10] and said it was tracking down the perpetrators of the hack.[9] Exchange customers, even those whose accounts had not been broken into, had their account balance reduced by 36% and received BFX tokens in proportion to their losses.[11] The exchange's access to U.S. dollar payments and withdrawals was then curtailed. The hack happened even though Bitfinex was securing the funds withBitGo, which usesmultiple-signature security.[12]
In July 2023, Bitfinex worked with theDepartment of Homeland Security to recover about $315,000 in cash and cryptocurrencies stolen in the 2016 breach. The funds will be redistributed to holders of Bitfinex's Recovery Right Tokens, digital coins issued to people who suffered financial losses due to the hack.[13]
In early 2017, small amounts of the stolen bitcoins began to be moved from the wallet it had been initially stored in to theDark Web marketplaceAlphaBay with the intention oflaundering it. After AlphaBay was shuttered by international law enforcement led by theFBI, the money was rerouted to the Russian marketplaceHydra. The shutdown of AlphaBay may have given law enforcement access to the service's internal transaction logs and allowed it to identify the perpetrators.[8]
In February 2022, a New York couple, Ilya Lichtenstein (aged 34) and his wife Heather R. Morgan (aged 31),[8] were charged by US federal authorities with conspiring to launder the bitcoins, which was worthUS$5.3 billion at the time.[2][14] Lichtenstein was an entrepreneur who had co-founded a sales company called MixRank. Morgan was an entrepreneur,columnist forInc., formerForbes digital contributor (from 2017 to 2021), and online rapper.[15][16] Although neither were charged with committing the hack, law enforcement had acquired asearch warrant for acloud storage service used by Lichtenstein, obtaining a spreadsheet of wallet addresses and passwords linked to the hack.[17] Though the stolen bitcoins could be tracked through public transactions logged on theblockchain, it was only after the wallet passwords were recovered that law enforcement could access and seize their contents.[8][18][19]
Some of the funds were moved to more traditional financial accounts and spent on gold,NFTs,Uber rides and aPlayStation.[20] Although hundreds of millions of dollars were converted to fiat currency, 80% of the bitcoins (approximately 94,000) remained in the original wallet at the center of the hack.[8]
In August 2023, Lichtenstein pleaded guilty to conspiracy to commit money laundering, and Morgan to one count of money laundering conspiracy and one count of conspiracy to defraud the United States. Lichtenstein additionally admitted to carrying out the hack.[4] Aninformation was filed against both defendants.[21]
In November 2024, Lichtenstein was sentenced to 60 months in prison and three years of supervised release.[22] Morgan was sentenced to 18 months in prison and three years of supervised release for fraud and conspiracy charges.[23]
On December 6, 2024,Netflix released a documentary directed byChris Smith featuring the story of Lichtenstein's and Morgan's crimes, titledBiggest Heist Ever.[24]
In 2025, PresidentDonald Trump signed an executive order to create aStrategic Bitcoin Reserve including Bitcoin seized by US law enforcement. In theory, this includes over 100,000 Bitcoin seized from the Bitfinex hackers, but the US Department of Justice has recommended to the courts that the Bitcoin seized after the hack be returned to Bitfinex.[25][26][27][28][29]
{{cite web}}: CS1 maint: multiple names: authors list (link)