The Bitfinex hack laundering

As of August 2026: Lichtenstein moved to community confinement on December 30, 2025 under First Step Act earned-time credits (not a pardon), and Morgan has completed her 18-month sentence. Disposition of the recovered bitcoin remained with the forfeiture process.

Also known as: Razzlekhan case.

What happened?

In August 2016, an intruder breached the Hong Kong-based cryptocurrency exchange Bitfinex and, through more than 2,000 unauthorized transactions, moved 119,754 bitcoin into an outside wallet. At the time the haul was worth about $70 million; bitcoin’s rise would eventually make it worth billions. The theft was one of the largest in crypto history, and for over five years nobody knew who had done it.

The answer turned out to be a married couple living in Manhattan. Ilya Lichtenstein was a tech entrepreneur; Heather Morgan wrote business columns and performed cringe-inducing rap videos under the name “Razzlekhan,” styling herself the “Crocodile of Wall Street.” In February 2022, federal agents arrested them both: not, initially, for the hack, but for conspiring to launder its proceeds. At Lichtenstein’s guilty plea in August 2023, the remaining mystery closed: he admitted he was the original hacker.

The case set a record on the way in. When agents arrested the couple, they seized about 94,000 of the stolen bitcoin: roughly $3.6 billion at the time, the largest financial seizure in Department of Justice history to that date. By the time of sentencing in late 2024, the recovered assets were worth around $10 billion.

Which techniques did it use?

The couple’s problem was the defining problem of crypto laundering: the stolen coins sat in a wallet that every investigator in the world could watch. Bitcoin’s ledger is public and permanent, so spending the money meant breaking the visible link between the hack wallet and any account carrying a real name.

According to the DOJ, they attacked that link from every direction. They opened accounts at exchanges using fictitious identities. They pushed coins through darknet markets such as AlphaBay, depositing on one side and withdrawing “different” coins on the other, so the market’s internal ledger swallowed the trail. They used mixing services, including Bitcoin Fog, which pool many users’ coins and pay out unrelated ones. They practiced chain-hopping, converting bitcoin into other cryptocurrencies to force investigators onto new ledgers. Case filings and supporting analyses also describe classic peel chains: long sequences of transactions that shave small amounts off a large balance at each hop.

At the far end came integration: funds landed in US business accounts dressed up as legitimate income, and some value left the blockchain entirely, converted into gold coins.

How was it found?

Slowly, and then completely. The laundering was elaborate, but every on-chain move was recorded forever, and blockchain analytics kept improving during the five years the couple worked. Investigators from IRS Criminal Investigation, the FBI and HSI traced funds from the 2016 hack wallet through the darknet accounts, mixers and hopping paths to exchange accounts that ultimately connected to Lichtenstein and Morgan themselves. When agents executed search warrants in early 2022, they recovered the keys to the wallet still holding the bulk of the stolen bitcoin (the roughly 94,000 BTC seizure announced with the arrests).

The lesson investigators drew is now standard doctrine: a public ledger means the trail never goes cold. Techniques that defeated tracing in 2017 could be unwound by the tools of 2021, because the evidence, unlike cash, cannot be spent, shredded, or forgotten.

What was the outcome?

On August 3, 2023, both defendants pleaded guilty: Lichtenstein to money laundering conspiracy, Morgan to the same plus conspiracy to defraud the United States. In November 2024, Judge Colleen Kollar-Kotelly sentenced Lichtenstein to five years in prison (November 14) and Morgan to 18 months (November 18). The sentences, modest against a multi-billion-dollar theft, reflected extensive cooperation with the government and the near-total recovery of the stolen assets, which moved into forfeiture proceedings with Bitfinex pressing its claim as victim.

The epilogue came quickly. On December 30, 2025, Lichtenstein was transferred from federal prison to community confinement under the First Step Act, which allows inmates to earn time credits toward early release. Some coverage framed it as leniency; it was neither a pardon nor clemency, but routine sentence administration. Morgan had already completed her term.

What changed afterwards?

The case rewrote assumptions on both sides of the ledger. For criminals, it demonstrated that mixers, darknet churn and chain-hopping only delay attribution, and that holding stolen coins for years multiplies the incentive for investigators to keep digging as the price rises. The mixer the couple relied on did not survive either: Bitcoin Fog’s operator was convicted in March 2024 and sentenced that November to more than 12 years.

For enforcement, the case proved that seizure at scale was possible. A theft once written off as unsolvable ended with roughly 80% of the coins in government custody, a record that stood until larger crypto forfeitures followed, and it cemented blockchain tracing, rather than reporting paperwork alone, as the backbone of crypto investigations. It also sharpened exchange practice: the fake-identity accounts the couple used are exactly what modern KYC programs and analytics screening at exchanges are built to catch. The contrast with state-backed thieves is instructive, though: where the Bitfinex launderers waited and got caught, North Korea’s Lazarus Group launders in days.

▶ Play video

First published August 28, 2026 · Last updated August 28, 2026 · Legal statuses current as of August 2026