NYC Couple Pleads Guilty to Money Laundering in $3.6 Billion Bitfinex Hack

A married couple from New York City has pleaded guilty to money laundering charges in connection with the 2016 hack of cryptocurrency stock exchange Bitfinex, resulting in the theft of about 120,000 bitcoin.

The development comes more than a year after Ilya Lichtenstein, 35, and his wife, Heather Morgan, 33, were arrested in February 2022, following the seizure of roughly 95,000 of the stolen crypto assets that were held by the defendants. The funds were valued at $3.6 billion at the time.

Since then, the U.S. government said it has since seized another approximately $475 million tied to the breach.

“Lichtenstein used a number of advanced hacking tools and techniques to gain access to Bitfinex’s network,” the U.S. Department of Justice (DoJ) said. “Once inside their systems, Lichtenstein fraudulently authorized more than 2,000 transactions in which 119,754 bitcoin was transferred from Bitfinex to a cryptocurrency wallet in Lichtenstein’s control.”

He is also alleged to have roped in his wife to launder the crypto proceeds using methods both diverse and intricate: setting up online accounts via fake identities, exchanging a chunk of the bitcoin into gold coins and other crypto assets, and covering up the trail by sending the funds through mixing services.

A large portion of the illegal money was moved to the now-defunct darknet market AlphaBay, blockchain analytics firm Chainalysis noted last month, which it said was used as a mixer by depositing the stolen Bitcoin and withdrawing equivalent amounts.

Following the law enforcement takedown of AlphaBay, the cryptocurrency was sent to other mixers and virtual currency exchanges (VCEs). Then in 2020 and 2021, a part of the digital assets were converted to fiat currency and moved to a U.S. bank account.

The pair further purchased gift cards for Walmart and other businesses at another VCE (named VCE 10 in court documents) – which offered a specialized service devoted to crypto-for-gift card trades – using the bitcoin that was moved to the exchange previously.

“In the end, the gift card purchases described above provided crucial clues in the investigation,” Chainalysis said.

“After tracing the initial movements of cryptocurrency, investigators discovered that a personal wallet address beginning with 36B6mu, which had received over $1 million worth of Bitcoin associated with the Bitfinex hack, provided funding for the account at VCE 10 used to purchase gift cards.”

The probe also found that the Walmart gift card specifically was redeemed through the retail giant’s iPhone app under an account in Morgan’s name, enabling authorities to get a search warrant for the couple’s home and their cloud storage accounts.

The latter turned out to be a major break, as it led to the discovery of files containing details of the cryptocurrency addresses used to move the stolen funds, including their private keys, along with the fraudulent information used to open accounts at various crypto exchanges and their plans to acquire fake passports.

Lichtenstein, a Russian national, faces a maximum penalty of 20 years in prison, with Morgan, who pleaded guilty to one count of money laundering conspiracy and one count of conspiracy to defraud the U.S., awaits a maximum jail term of 10 years.