A married New York City couple has pleaded guilty to money laundering charges in connection with the 2016 hack of cryptocurrency stock exchange Bitfinex that resulted in the theft of approximately 120,000 bitcoin.
The developments come more than a year after Ilya Lichtenstein, 35, and his wife, Heather Morgan, 33, were arrested in February 2022, leading to the seizure of approximately $95,000 worth of stolen crypto assets held by the defendants. The fund was valued at $3.6 billion at the time.
Since then, the US government said it has seized approximately $475 million more related to the breach.
“Lichtenstein used a number of advanced hacking tools and techniques to gain access to Bitfinex’s network,” the US Department of Justice (DOJ) said. “Once inside his system, Lichtenstein fraudulently authorized more than 2,000 transactions in which 119,754 bitcoins were transferred from Bitfinex to a cryptocurrency wallet under Lichtenstein’s control.”
He is also alleged to have roped in his wife to launder the crypto proceeds using methods both diverse and intricate: setting up online accounts via fake identities, exchanging a chunk of the bitcoin into gold coins and other crypto assets, and covering up the trail by sending the funds through mixing services.
A large portion of the illegal money was moved to the now-defunct darknet market AlphaBay, blockchain analytics firm Chainalysis noted last month, which it said was used as a mixer by depositing the amount stolen bitcoin and withdrawing equivalents.
After AlphaBay was taken down by law enforcement, the cryptocurrency was sent to other mixers and virtual currency exchanges (VCEs). Then in 2020 and 2021, a portion of the digital assets were converted to fiat currency and transferred to a US bank account.
The pair bought gift cards for Walmart and other businesses on another VCE (named VCE10 in court documents) — which offered a specialized service dedicated to crypto-for-gift card trades — that bitcoin. By using what was previously moved to the exchange.
“Ultimately, the gift card purchases described above provided important leads in the investigation,” Chainalysis said.
“After tracing the initial movements of the cryptocurrency, investigators discovered that a personal wallet address beginning with 36B6mu, which had received over $1 million worth of Bitcoin associated with the Bitfinex hack, provided funding for the account at VCE 10 used to purchase gift cards.”
The investigation also found that Walmart gift cards were redeemed exclusively through the retail giant’s iPhone app under an account in Morgan’s name, prompting authorities to obtain search warrants for the couple’s home and their cloud storage accounts.
The latter proved to be a big break, as it led to the discovery of files detailing the cryptocurrency addresses used to transfer the stolen funds, including their private keys, as well as accounts opened at various crypto exchanges. Fraud information was also included. Their plan is to get fake passports made.
Lichtenstein, a Russian national, faces a maximum penalty of 20 years in prison, while Morgan, who pleaded guilty to one count of money laundering conspiracy and one count of conspiracy to defraude the US, awaits a maximum jail term of 10 years.
