Sign in

Bitfinex Hack

avoid.net/bitfinex-hack→10/100·97% conf.
[AI-DRAFTED · AWAITING VERIFICATION]
10/100
[CRITICAL]97% conf.

Summary

On August 2, 2016, the Hong Kong-based cryptocurrency exchange Bitfinex was breached by Ilya Lichtenstein, who fraudulently authorized more than 2,000 transactions to steal 119,756 BTC valued at approximately $72 million at the time. The exchange socialized losses across all customers and issued BFX recovery tokens, redeeming them fully by April 2017. In February 2022, the U.S. Department of Justice arrested Lichtenstein and his wife Heather Morgan, seizing over $3.6 billion in Bitcoin in what was then the largest financial seizure in DOJ history; both pleaded guilty in August 2023 and were sentenced in November 2024.

Have evidence about Bitfinex Hack?

No evidence submitted yet — be the first.

On-chain audit

Editorial decisions, corrections, and updates are anchored on Solana.

audit log →version history →

The August 2016 Breach

On August 2, 2016, Ilya Lichtenstein exploited a vulnerability in Bitfinex's multisignature security infrastructure to execute one of the largest cryptocurrency thefts in history. Bitfinex had implemented a 2-of-3 multisignature arrangement per user wallet, with Bitfinex holding two keys and BitGo, a third-party security firm, co-signing transactions with the third key. Lichtenstein allegedly found a method to bypass BitGo's approval process, enabling him to initiate and authorize more than 2,000 withdrawal transactions transferring approximately 119,754 BTC to a wallet under his control without triggering the required BitGo confirmations. The stolen bitcoin was valued at approximately $71–72 million at the time of the theft. Following the announcement, bitcoin's market price fell approximately 20%, reducing the immediate dollar value of the stolen funds to around $58 million. Lichtenstein subsequently deleted access credentials and log files from Bitfinex's network in an effort to cover his tracks.

Sources

Socialized Losses and BFX Token Recovery Program

Rather than selectively compensating only affected account holders or absorbing the loss at the corporate level, Bitfinex implemented a controversial loss-socialization strategy. All customer account balances, including those of users whose accounts had not been directly breached, were reduced by a uniform 36.067%. In compensation, Bitfinex issued BFX tokens to affected customers at a ratio of 1 BFX per 1 U.S. dollar of loss. These tokens could be traded on the open market, redeemed directly by Bitfinex at a face value of $1.00, or converted into equity shares of Bitfinex's parent company iFinex Inc. at the same rate. Customers who converted BFX tokens to iFinex equity received an additional instrument called Recovery Right Tokens (RRTs), which entitled holders to up to $1.00 per RRT from any future recovery of the stolen bitcoin, after outstanding BFX obligations were satisfied. By April 3, 2017 — approximately eight months after the breach — Bitfinex announced that all outstanding BFX tokens had been fully redeemed at face value or converted to equity, eliminating direct customer liabilities from the hack.

Sources

Money Laundering Operation (2016–2022)

Following the theft, Lichtenstein enlisted his wife Heather Morgan to assist in laundering the stolen funds. Over the following years, Lichtenstein and Morgan employed numerous sophisticated laundering methods including: using fictitious identities to set up online accounts at cryptocurrency exchanges; deploying automated scripts to conduct layered transactions; depositing funds into darknet markets and then withdrawing equivalent amounts as a mixing technique (notably using the darknet market AlphaBay in January 2017 as a de facto mixer before its shutdown in 2017); converting bitcoin to other cryptocurrencies in a practice known as chain hopping; depositing portions of the proceeds into bitcoin mixing services; using U.S.-based business accounts to add a veneer of legitimacy to transactions; and exchanging some proceeds into physical gold coins. Blockchain analytics firm Elliptic tracked billions of dollars in proceeds from the stolen funds moving through these channels over a period of approximately six years.

Sources

2022 Arrests and DOJ Asset Seizure

On February 8, 2022, the U.S. Department of Justice announced the arrest of Ilya Lichtenstein, 34, and Heather Morgan, 31, both of New York City, on charges of conspiracy to commit money laundering and conspiracy to defraud the United States. Federal agents had obtained access to a cloud storage account controlled by Lichtenstein that contained a file storing private keys to the primary wallet holding the stolen bitcoin. This enabled investigators to lawfully seize and recover more than 94,000 BTC. At the time of seizure, the recovered assets were valued at approximately $3.6 billion, making it the largest financial seizure in U.S. Department of Justice history at that point. The government characterized the total funds alleged to have been laundered as approximately $4.5 billion. Homeland Security Investigations (HSI) and IRS Criminal Investigation (IRS-CI) conducted the investigation.

Sources

Guilty Pleas (August 2023)

On August 3, 2023, both Ilya Lichtenstein and Heather Morgan pleaded guilty in U.S. District Court in Washington, D.C. Lichtenstein pleaded guilty to one count of conspiracy to commit money laundering and, critically, admitted for the first time publicly that he was the individual who had executed the original 2016 hack of Bitfinex. Morgan pleaded guilty to one count of money laundering conspiracy and one count of conspiracy to defraud the United States. The DOJ's announcement confirmed that the couple conspired to launder the proceeds of approximately 119,754 BTC stolen from Bitfinex. The guilty pleas resolved the criminal proceedings that had been pending since their February 2022 arrests.

Sources

Sentencing (November 2024)

On November 14, 2024, Ilya Lichtenstein was sentenced to 60 months (five years) in federal prison by U.S. District Court in Washington, D.C., for his role in the money laundering conspiracy arising from the hack and theft of approximately 120,000 bitcoin. In addition to the prison term, Lichtenstein was ordered to serve three years of supervised release. On November 18, 2024, Heather Morgan was sentenced to 18 months in federal prison for her role in assisting the laundering operation. Morgan received a lighter sentence reflecting her lesser culpability relative to Lichtenstein. At the time of sentencing, the government had recovered approximately $10 billion in assets related to the case — reflecting both additional seizures and the dramatic appreciation in bitcoin's market value since the 2022 initial recovery. The court ordered restitution, with Bitfinex being designated as the sole eligible victim for recovery purposes by the U.S. government.

Sources

Early Release of Ilya Lichtenstein (January 2026)

On January 2, 2026, Ilya Lichtenstein was released from federal prison after serving approximately 14 months of his five-year sentence. Lichtenstein publicly credited his early release to the First Step Act, a bipartisan prison reform law originally signed by President Trump in 2018, which allows non-violent federal inmates to earn time credits through participation in work, education, and rehabilitation programs. Because Lichtenstein's conviction was for money laundering conspiracy — classified as a non-violent offense — he qualified for accumulated time credits that made him eligible for early release to home confinement. A Trump administration official confirmed he was released to home confinement in accordance with Bureau of Prisons policies. Heather Morgan had previously been released after serving approximately eight months of her 18-month sentence.

Sources

Asset Recovery and Restitution Disputes

The U.S. government's initial February 2022 seizure of approximately 94,000 BTC was valued at over $3.6 billion — at the time, the largest financial seizure in DOJ history. Subsequent seizures and bitcoin price appreciation raised the total government-recovered value to approximately $10 billion by the time of sentencing in November 2024. A court-ordered restitution of approximately $9 billion in bitcoin was also reported. The question of who should receive the recovered funds became contentious: Bitfinex argued it was the rightful beneficiary and stated it would use 80% of any recovered proceeds to buy back and burn its LEO token (a platform utility token) while returning a portion to select customers in cash. The U.S. government filed documents designating Bitfinex as the sole eligible victim for restitution purposes, excluding individual customers who had been compensated through the BFX token program. Individual customers who held RRT tokens disputed this characterization, arguing they retained claims on recovered funds.

Sources

Timeline

2016-08-02

Ilya Lichtenstein hacks Bitfinex, executing over 2,000 unauthorized transactions and stealing 119,756 BTC worth approximately $72 million.

2016 Bitfinex Hack - Wikipedia

2016-08-03

Bitfinex publicly discloses the breach; bitcoin's price falls approximately 20%. Bitfinex halts all trading and withdrawals.

The Bitfinex Bitcoin Hack: What We Know (And Don't Know) - CoinDesk

2016-08-06

Bitfinex announces the socialized loss mechanism, reducing all customer account balances by 36.067% and issuing BFX tokens as compensation.

2016 Bitfinex Hack - Wikipedia

2017-01-01

Lichtenstein and Morgan move a large portion of stolen funds to the darknet market AlphaBay, using it as a bitcoin mixer.

Bitfinex Hack Money Launderers Plead Guilty - Chainalysis

2017-04-03

Bitfinex announces full redemption of all outstanding BFX tokens at $1.00 face value, eliminating direct customer liabilities from the hack.

Bitfinex Makes Good on Debt, 100% of BFX Tokens Redeemed - Bitcoin.com News

2022-02-08

DOJ arrests Ilya Lichtenstein and Heather Morgan in New York City on charges of conspiracy to commit money laundering. Investigators seize more than 94,000 BTC valued at approximately $3.6 billion — the largest financial seizure in DOJ history at the time.

Feds Seize $3.6 Billion in Bitcoin Stolen from Bitfinex Hack - CNBC

2023-08-03

Ilya Lichtenstein and Heather Morgan both plead guilty to money laundering conspiracy in U.S. District Court in Washington, D.C. Lichtenstein admits publicly for the first time to executing the original 2016 hack.

Husband and Wife Plead Guilty to Money Laundering Conspiracy - DOJ

2024-11-14

Ilya Lichtenstein is sentenced to 60 months (five years) in federal prison and three years of supervised release.

Bitfinex Hacker Sentenced in Money Laundering Conspiracy - DOJ

2024-11-18

Heather Morgan is sentenced to 18 months in federal prison for her role in the laundering operation.

Bitfinex Hack Launderer Heather 'Razzlekhan' Morgan Sentenced to 18 Months - CoinDesk

2026-01-02

Ilya Lichtenstein is released from federal prison after approximately 14 months, qualifying for early release under the First Step Act due to the non-violent classification of his offense.

Bitcoin Hacker Ilya Lichtenstein Thanks Trump for Early Prison Release - CNBC

model: claude-code-investigator

generated: 5/8/2026, 2:31:08 AM

last updated: 5/8/2026, 2:42:01 AM

avoid.net — verified advice for a post-truth world