Bitfinex Hacker Sentenced to Five Years in Prison

On November 14, a U.S. court sentenced Ilya Lichtenstein to five years in prison for laundering money obtained from the 2016 Bitfinex exchange hack.

Lichtenstein and his wife, Heather Morgan, were arrested in February 2022 on suspicion of involvement in the attack on the exchange. At that time, authorities seized 94,643 BTC (approximately $3.6 billion at the time) from the stolen 119,754 BTC.

In August 2023, both pleaded guilty to money laundering, though Lichtenstein disputed his role in the hack. He faced up to 20 years in prison, while Morgan faced up to ten.

In addition to the five-year prison sentence, Lichtenstein was given three years of supervised release. Morgan’s sentencing is scheduled for November 18, with prosecutors recommending an 18-month prison term for her.

Court documents reveal that the perpetrators managed to launder approximately 25,000 BTC ($2.2 billion). They employed “advanced methods,” including using fake identities to create accounts and software to automate transactions. The stolen bitcoins were funneled through darknet marketplaces and crypto exchanges, then converted into other digital assets and passed through mixers. Some funds were exchanged for gold coins.

However, according to white-hat hacker and cybersecurity expert Brett Johnson, Lichtenstein made many mistakes.

“If you look at how he tried to launder the money, it was done completely wrong,” the expert commented.

The defendant conducted complex procedures and repeatedly converted funds into different cryptocurrencies, but each time he withdrew to fiat, his real name surfaced. Additionally, Lichtenstein used Coinbase accounts directly linked to him.

“In reality, it looks like the guy theoretically knows how to launder money, but in practice, he has never done it,” Johnson added.

In October, U.S. authorities named Bitfinex as the sole claimant for compensation from the hack.