'Bitcoin’s biggest heist': How did Ilya Lichtenstein pull off the $10 billion cyber theft?

In August 2016, Ilya Lichtenstein, a 35-year-old entrepreneur with roots in the tech industry, infiltrated the network of Hong Kong-based cryptocurrency exchange Bitfinex.

Utilising sophisticated hacking tools, he initiated over 2,000 unauthorised transactions, funnelling around 120,000 bitcoins to a personal crypto wallet. “The defendant perpetrated what was at the time one of the largest thefts from a virtual currency exchange,” prosecutors noted.

At the time of the hack, the stolen Bitcoin was valued at $71 million. However, due to Bitcoin’s skyrocketing market price over the years, that amount has ballooned to a staggering $10.5 billion today.

Lichtenstein’s wife, Heather Morgan, also known by her rap alias “Razzlekhan,” initially unaware of the hack, later became a crucial accomplice. The pair embarked on a years-long journey of laundering the funds, a process prosecutors described as “the most complicated money laundering techniques” ever encountered by IRS agents.

How the couple laundered the money

Months after the hack, Lichtenstein and Morgan began an elaborate scheme to disguise the origin of the stolen bitcoins. The couple moved funds through numerous accounts, employing fake identities and breaking up transactions into smaller amounts to evade detection.

They used various crypto exchanges, darknet markets, and even purchased NFTs, gold, and Walmart gift cards to launder the money. Prosecutors noted, “Over half a decade, the defendant engaged in what IRS agents described as the most complicated money laundering techniques they had seen to date.”

Authorities discovered that Lichtenstein had been secretly moving funds to accounts overseas and had even enlisted couriers to transport cash, with notable transactions during family trips to Kazakhstan and Ukraine.

Also Read | Power theft uncovers illegal bitcoin mine in Thailand’s Bangkok

An attorney for Bitfinex, Barry Berke, explained that the theft represented roughly 36 per cent of Bitfinex’s assets at the time, “devastating” the company’s finances and requiring immediate measures to absorb the loss and protect customers.

The heist remained under the radar until February 2022, when authorities arrested the couple in their New York City apartment. During the arrest, Deputy Attorney General Lisa Monaco announced that officials had managed to seize over 94,000 bitcoin, valued at more than $3.6 billion at that time — a historic recovery in the Justice Department’s history.

What charges did Lichtenstein and Morgan face

Facing up to 20 years in prison, Lichtenstein pleaded guilty in August 2023 to one count of conspiracy to commit money laundering, ultimately receiving a five-year prison sentence. In addition to the prison term, he was ordered to serve three years of supervised release.

Judge Colleen Kollar-Kotelly, overseeing the case, highlighted the planned nature of the crime, stating, “It’s important to send a message that you can’t commit these crimes with impunity, that there are consequences to them.”

Lichtenstein expressed remorse, saying, “I want to take full responsibility for my actions and make amends any way I can,” and vowed to use his skills to combat cybercrime upon his release. He also implored the judge to be lenient with his wife, taking the blame for her involvement. “Heather is only involved in this case because of me,” he added.

Morgan, scheduled for sentencing on November 18, was described by prosecutors as a “lower-level participant” who became involved three years after the hack. The government has recommended an 18-month sentence for her.

Morgan, a business owner and writer who performed music under the alias “Razzlekhan,” adopted her own hip-hop persona, publicly promoting her work and leading a seemingly ordinary life while assisting in the laundering operations.

What happens to the recovered funds

Thanks to Lichtenstein’s cooperation following his arrest, authorities were able to recover approximately 96 per cent of the stolen funds, which will likely be returned to Bitfinex and other potential claimants.

Defence attorney Samson Enzer said that “the vast bulk of the stolen money was never spent” and that Lichtenstein’s assistance has significantly benefited other ongoing cybercrime investigations.

Lichtenstein’s contributions extended beyond this case; he provided crucial information in related investigations, even testifying in a trial involving Bitcoin Fog, a mixing service used to obfuscate cryptocurrency transactions.

Reflecting on his choices, Lichtenstein’s attorney stated, “This is not an evil person, this is a good person who made some very bad mistakes.” Nonetheless, prosecutors voiced concerns about his potential future as a money launderer, warning that his experience with laundering techniques might aid future schemes.

The Bitfinex hack has been recognised as one of the largest thefts in the cryptocurrency world. According to US District Judge Kollar-Kotelly, “This is so massive, it is not comparable to other crypto crimes based on its scale and complexity.”

Lichtenstein’s skill as a “highly skilled computer expert” contributed to the success of this years-long operation, though the consequences have now caught up with him and his accomplice.

Also Watch:

With inputs from agencies