Pierluigi Paganini August 04, 2023

A married couple from New York pleaded guilty this week to laundering billions of dollars stolen from Bitfinex in 2016.

The couple pleaded guilty to money laundering charges in connection with the hack of the cryptocurrency stock exchange Bitfinex that took place in 2016.

The hackers stole 120,000 Bitcoin and the theft had serious repercussions on the Bitcoin value that significantly dropped after the discovery of the breach, a 20 percent decrease following the hack.

In February 2022, Ilya Lichtenstein (35) and his wife, Heather Morgan (32), were arrested for alleged conspiracy to launder $4.5 Billion in stolen cryptocurrency stolen during the 2016 hack of Bitfinex. Law enforcement also seized over $3.6 billion in cryptocurrency (roughly 95,000 of the stolen crypto assets) linked to that hack.

Since the arrest of the couple, the government has seized another approximately $475 million tied to the cyber heist.

Lichtenstein used a number of advanced hacking tools and techniques to breach Bitfinex’s network and once gained access to its infrastructure fraudulently authorized more than 2,000 transactions in which 119,754 bitcoin was transferred from Bitfinex to a cryptocurrency wallet in his control.

Lichtenstein also managed to cover his tracks by deleting access credentials and other log files. Lichtenstein’s wife, Morgan, helped the man in laundering the stolen funds.

The duo used fake identities to set up online accounts, software to automate transactions, exchanged a portion of the stolen funds into gold coins and other crypto assets, and used mixing services like ChipMixer.

“Lichtenstein, at times with Morgan’s assistance, employed numerous sophisticated laundering techniques, including using fictitious identities to set up online accounts; utilizing computer programs to automate transactions; depositing the stolen funds into accounts at a variety of darknet markets and  cryptocurrency exchanges and then withdrawing the funds, which obfuscates the trail of the transaction history by breaking up the fund flow; converting bitcoin to other forms of cryptocurrency, including anonymity-enhanced  cryptocurrency (AEC), in a practice known as “chain hopping”; depositing a portion of the criminal proceeds into cryptocurrency mixing services, such as Bitcoin Fog, Helix, and ChipMixer; using U.S.-based business accounts to legitimize their banking activity; and exchanging a portion of the stolen funds into gold coins, which Morgan then concealed by burying them.” states the press release of DoJ.

Lichtenstein faces a maximum penalty of 20 years in prison, with his wife. Morgan pleaded guilty to one count of money laundering conspiracy and one count of conspiracy to defraud the U.S., she faces a maximum penalty of 10 years in prison.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Bitfinex)