Bitfinex's 119,754-bitcoin hack ended with its launderers in prison

In August 2016 a hacker breached crypto exchange Bitfinex's systems and initiated more than 2,000 unauthorized transactions, sending 119,754 bitcoin — worth about $70 million at the time — to a wallet controlled by Ilya Lichtenstein, prosecutors say. It was one of the largest exchange thefts of its era.

For years the coins sat and moved through a laundering maze: deposits into darknet markets, chain-hopping between tokens, mixing services, conversion into gold coins, Walmart and Amazon gift cards, and US business accounts used to legitimize cash-outs. In February 2022 Lichtenstein and his wife Heather Morgan, a Forbes contributor who rapped as 'Razzlekhan', were arrested in New York. The DOJ seized more than 94,000 bitcoin — over $3.6 billion at the time — its largest single financial seizure ever.

Both pleaded guilty to money laundering conspiracy in August 2023, where Lichtenstein first admitted he was the hacker; Morgan also pleaded guilty to conspiracy to defraud the United States. In November 2024 a Washington federal judge sentenced Lichtenstein to five years plus supervised release and Morgan to 18 months. Investigators recovered nearly the full stash after decrypting Lichtenstein's meticulous laundering spreadsheet, and prosecutors said they anticipate returning most or all of the assets to Bitfinex through restitution — by then worth close to $10.5 billion.

119,754 BTC left the exchange — about $70M in 2016, $4.5B at the 2022 arrest, roughly $10.5B by sentencing

The architecture let one breach authorise thousands of withdrawals, so a single intrusion could drain the exchange — a controls failure, not just a break-in.

Every laundering trick the couple used preserved provenance on the public blockchain; Chainalysis traced Walmart gift cards back to hack proceeds and the case unspooled from there.

The thief kept meticulous records of the money-laundering workflow in an encrypted spreadsheet — decrypted, it became the roadmap that let the government recover nearly everything.

Concentrated hot wallets plus withdrawal controls one breach can abuse turn an exchange into a honeypot. On-chain forensics outlasts mixers and gift cards — the bill arrives years later.

With credit for time served and good behavior, Lichtenstein could be released in under two years from his five-year sentence; Morgan, whom prosecutors called a lower-level participant who joined three years after the hack, got 18 months. The seized bitcoin's appreciation means the eventual restitution to Bitfinex is worth many times the $3.6 billion booked at seizure. The case became the template for blockchain-tracing investigations cited across later crypto seizures.