Ilya Lichtenstein Sentenced to 5 Years in Prison for Role in Bitfinex Hack

Ilya Lichtenstein, a 35-year-old programmer, was sentenced to five years in prison for his part in laundering Bitcoin stolen from the Bitfinex crypto exchange.

The U.S. Department of Justice (DOJ) announced the sentence, marking a significant development in a case involving the theft of nearly 120,000 BTC, valued at $71.8 million in 2016 but worth over $4.5 billion by the time of his 2022 arrest.

The Bitfinex Hack

According to court documents, the 35-year-old was responsible for infiltrating Bitfinex’s network using sophisticated hacking tools. Once inside, he transferred 119,754 BTC from the exchange to a crypto wallet under his control by executing over 2,000 unauthorized transactions.

Following the hack, Lichtenstein attempted to cover his tracks by removing access credentials and log files from the Bitfinex network, which could have provided evidence to investigators. He later enlisted his wife, Heather Morgan, to help him launder the stolen loot.

The DOJ revealed that Lichtenstein and Morgan used multiple techniques to disguise the origins of the stolen cryptocurrency. Among these were the use of fake identities to set up online accounts, the deployment of software to automate transactions, as well as converting the Bitcoin into other cryptocurrencies, a tactic known as “chain hopping.”

Additionally, the couple deposited portions of the stolen funds into darknet markets and multiple crypto exchanges and later withdrew them into various accounts to evade tracking.

They also used cryptocurrency mixing services such as Bitcoin Fog to anonymize transactions and opened U.S.-based business accounts to make their banking activity appear legitimate. Further, Lichtenstein and Morgan converted some of the money into gold coins.

Lichtenstein’s Sentencing

The 2016 Bitfinex hack remains one of the largest known cybercrimes in the digital asset space. Though initially only suspected of laundering funds, Lichtenstein later confessed to being the hacker behind the breach.

However, despite his admission, neither he nor Morgan were charged directly with executing the exploit. Instead, both pleaded guilty on August 3, 2023, to a single count of conspiracy to commit money laundering, a charge carrying a maximum sentence of up to 20 years in prison.

Following their arrest in February 2022, law enforcement traced and recovered approximately $3.6 billion of the stolen Bitcoin. A portion of these funds was returned to the exchange.

In addition to his five-year prison sentence, Lichtenstein will serve three years of supervised release after his term. Morgan, meanwhile, is scheduled to be sentenced on November 18.