Bitfinex Hack 2016
Summary
On August 2, 2016, Bitfinex — a Hong Kong-based cryptocurrency exchange — was breached by hacker Ilya Lichtenstein, who exploited security failures in the exchange's multi-signature wallet architecture to steal 119,756 BTC (approximately $72 million at the time). Bitfinex controversially socialized the losses across all user accounts with a 36.067% haircut and issued BFX debt tokens, which were fully redeemed at par by April 2017. In February 2022, the U.S. Department of Justice arrested Lichtenstein and his wife Heather Morgan after seizing approximately 94,000 BTC worth $3.6 billion — the largest financial seizure in DOJ history at the time — and both subsequently pleaded guilty; Lichtenstein was sentenced to 5 years (released early in January 2026) and Morgan to 18 months.
Connected Entities
1 entities · 10 linked investigationsTimeline(10 events)
2016-08-02
Ilya Lichtenstein breaches Bitfinex's systems, executing approximately 2,000 unauthorized withdrawal transactions totaling 119,756 BTC (~$72 million) to a wallet under his control.
DOJ press release / CNBC2016-08-02
Bitfinex halts all trading and withdrawals following discovery of the breach. Bitcoin price drops approximately 20%.
CoinDesk2016-08-07
Bitfinex implements a 36.067% 'generalized haircut' across all customer balances, issuing BFX debt tokens at a 1:1 USD ratio to compensate affected and non-affected users alike.
Wikipedia / Coin Bureau2017-04-03
Bitfinex completes full redemption of all outstanding BFX tokens at $1.00 par value, approximately eight months after issuance.
Bitfinex Blog2022-02-08
The U.S. Department of Justice arrests Ilya Lichtenstein and Heather Morgan in New York City and seizes approximately 94,000 BTC valued at ~$3.6 billion — the largest financial seizure in DOJ history at that time.
DOJ press release2023-05-01
OCCRP publishes investigation revealing that Bitfinex commissioned — and withheld — a confidential Ledger Labs security report identifying critical failures that enabled the 2016 hack.
OCCRP2023-08-03
Ilya Lichtenstein and Heather Morgan plead guilty to money laundering conspiracy in Washington D.C. federal court. Lichtenstein admits for the first time to committing the original 2016 hack.
CNBC / DOJ2024-11-14
Ilya Lichtenstein sentenced to 60 months (5 years) in federal prison. Heather Morgan sentenced to 18 months.
The Hacker News / Bank Info Security2025-01-01
U.S. federal court orders in-kind restitution of approximately 94,000 BTC to Bitfinex via plea agreement provisions, after ruling Bitfinex does not qualify as a 'victim' under the Mandatory Victims Restitution Act.
BeInCrypto / Bitcoin.com News2026-01-02
Ilya Lichtenstein released from federal prison after approximately 14 months, citing early release under the First Step Act. Placed on home confinement.
CoinDesk / TechCrunchDecision Log
- hash: HACiE3UwwJfjo2UNLzpbwRrmdvzU22gLEL1Giu2o8ydp
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 6/1/2026, 5:47:10 PM
last updated: 6/1/2026, 5:47:14 PM
avoid.net — verified advice for a post-truth world