A married couple was arrested on Tuesday by the US Department of Justice (DOJ) said for allegedly trying to launder roughly $4.5 billion worth of stolen Bitcoins. The cryptocurrency was first stolen during a massive 2016 exchange hack. At least 120,000 Bitcoins were stolen at the time, and believed to be worth $65 million.
The US Justice Department officials in a press statement called it a “record-shattering amount of stolen cryptocurrency” and said that they have “seized at least $3.6 billion in cryptocurrency linked to that hack that they will now try to return to its rightful owners.”
Meet the ‘masterminds’ of the operation
US authorities have identified the masterminds Ilya Dutch Lichtenstein and Heather Morgan as the masterminds behind the operation. Although the DOJ has not publicly linked them to the actual hacking of the cryptocurrency exchange, the investigation is ongoing.
Incidentally, Morgan has been quite popular on social media. She called herself a rap singer “Razzlekhan,” a pseudonym that she said on her website referred to Mongol conqueror Genghis Khan “but with more pizzazz.” A Reuters notes she also actively wrote on “Tips to Protect Your Business from Cybercriminals” and featured an interview with a cryptocurrency exchange owner about “how to prevent fraud.”
According to their LinkedIn profiles, Lichtenstein and Morgan have listed themselves as employees of SalesFolk since 2009 and 2014, respectively. Morgan’s LinkedIn bio suggests she was also a former columnist at Inc Magazine and Forbes, while Lichtenstein’s lists previous roles at MixRank, Endpass and 500 Startups.
Unveiling the scam
In 2016, Hong Kong-based cryptocurrency exchange Bitfinex said at least $65 million worth of crypto assets were stolen. Bitfinex had said that a total of 119,756 Bitcoins were taken by hackers and the impact of the loss was shared across the site’s users. “We have decided to generalise losses across all accounts. Upon logging into the platform, customers will see that they have experienced a generalised loss percentage of 36.067 per cent,” the company said in a statement at the time.
It is worth noting that the hacked crypto assets were never cashed out. This was possible because all other cryptocurrency exchanges blacklisted the hackers’ addresses. This prevented them from converting the stolen Bitcoin into fiat currency. This is only possible because cryptocurrency is powered by Blockchain technology which makes it easier to track any transaction.
The cryptocurrency was left sitting in the hackers’ accounts for the past four and a half years. However, in August 2021, suddenly more than $760 million worth of Bitcoin were moved to new crypto wallet accounts. According to a summary of recent transactions put together by The Record, this ranged from 10057.5798 to 12230.08861 Bitcoins. This huge fund movement alerted authorities to trace the wallet address of the hacker.
According to a statement of facts, “US authorities traced the stolen funds on the BTC blockchain” as proceeds from the hack moved out of the initial recipient wallet to wallets allegedly controlled by Lichtenstein and Morgan.
Law enforcement officials decrypted a file “saved to Lichtenstein’s cloud storage account” which included 2,000 crypto wallet addresses and their private keys. “Blockchain analysis confirmed that almost all of those wallets were directly linked to the hack,” the statement added.
NFTs, gold bought
After transferring Bitcoins to their crypto wallet, the duo spent the proceeds on items such as gold, NFTs and a $500 Walmart gift card, Reuters reported. The accused allegedly used a number of techniques to launder the stolen Bitcoin, including splitting transactions up into “thousands” of smaller transactions, converting them into other types of crypto such as monero, and then using darknet market.
According to the US DOJ, AlphaBay as one such platform allegedly used by the couple. The statement adds that some of the funds went to an account tied to a company called SalesFolk, which was owned by Morgan.
What is Bitfinex saying?
Bitfinex in a statement said that it was working with the Department of Justice to “establish our rights to a return of the stolen bitcoin.”
“If Bitfinex receives a recovery of the stolen bitcoin, Bitfinex will within 18 months of the date it receives that recovery, use an amount equal to 80 per cent of the recovered net funds to repurchase and burn outstanding tokens,” the company added.