Hacker Gets Five Years for Stealing Billions in Bitcoin
Ilya Lichtenstein and his wife, Heather Morgan, pleaded guilty to money laundering and conspiracy in a crypto scam. Lichtenstein has been sentenced to five years. Photo credit: Instagram @heatherreyhan.
The sentence comes after Lichtenstein and his wife, Heather Morgan, 34, also from New York City, pleaded guilty on Aug. 3, 2023, to conspiracy and money laundering.
On Nov. 18, a federal court sentenced Morgan to 18 months.
In August 2016, Lichtenstein hacked into Bifinex’s security systems and initiated over 2,000 Bitcoin (BTC) transactions, resulting in 119,754 BTC being transferred into an account that Lichtenstein and Morgan owned, according to the criminal complaint. The stolen Bitcoins were valued at $71 million in 2016 when they were stolen. The value was nearly $4.5 billion at the time of their arrest in February 2022, prosecutors claim.
To conceal the funds, in January 2017, Lichtenstein and Morgan moved some of the Bitcoins from the initial account to many smaller accounts on various platforms and in complex patterns to mask where the funds were headed, according to the criminal complaint. U.S. authorities, however, were able to trace the funds from the Bitcoin account to accounts belonging to Lichtenstein and Morgan.
Here is a non-exhaustive diagram of how Lichtenstein and Morgan attempted to launder the money:
Lichtenstein and Morgan used a method known as “chain hopping” to convert some of their Bitcoins to other currencies, using mixing services and cryptocurrency exchanges to withdraw funds, according to the most recent DOJ press release. The couple even exchanged some of the currency from the Bitcoins into gold coins.
Lichtenstein and Morgan also registered multiple AlphaBay accounts, with at least six of them being created with emails hosted by an Indian-based email provider, according to the criminal complaint. Bifinex managed to halt the operation of seven of Lichtenstein and Morgan’s accounts because they did not respond when asked for more verification, but the company only recovered around $186,000 worth of Bitcoin.
Lichtenstein and Morgan continued to create accounts using various email hosting companies in multiple countries, including Russia, Switzerland and India, over the next five years, according to the criminal complaint. Some of the stolen Bitcoins ended up in accounts with large companies like Walmart, Uber, Playstation and Hotels.com, as demonstrated in the chart below.
Although five years had passed between hacking Bifinex in 2016 and their arrest in 2022, Lichtenstein and Morgan had only moved 25,000 BTC, leaving 94,000 BTC in the original account they transferred it to, according to their Feb. 8, 2022, DOJ press release announcing their arrest. Special agents garnered a search warrant for Lichtenstein and Morgan’s electronic accounts and recovered the 94,000 BTC, valued at $3.6 billion when seized.
Lichtenstein and Morgan pleaded guilty to one count each of conspiracy to commit money laundering, according to the most recent DOJ press release about Lichtenstein’s sentencing. Along with Lichtenstein’s five-year sentence, he will also serve an additional three years of supervised release.
Discover More Muck
Yakuza Leader Trafficked Nuclear Material, Narcotics and Weapons
Report Jessika Saunders | Feb 13, 2025
Arizona Man Gets More Than 36 Years In Prison for Burning Down Two Churches
Report Jessika Saunders | Feb 11, 2025
Cells in the Cells: Inmates Use Contraband Phones To Commit Crimes in Communities
Feature Raymond L. Daye | Feb 10, 2025
Weekly Muck
Join the mission and subscribe to our newsletter. In exchange, we promise to fight for justice.
Weekly
Muck
Join the mission and subscribe to our newsletter. In exchange, we promise to fight for justice.
