In connection with the 2016 hack of cryptocurrency stock exchange Bitfinex, which resulted in the theft of around 120,000 bitcoin, a married couple from New York City has admitted guilt on counts of money laundering.
The news comes more than a year after Ilya Lichtenstein, 35, and his wife Heather Morgan, 33, were taken into custody in February 2022 after having some 95,000 stolen crypto assets seized from their possession. At the time, the funds had a $3.6 billion value.
The American government reported seizing an additional $475 million linked to the breach since then.
According to the U.S. Department of Justice (DoJ), “Lichtenstein used a number of sophisticated hacking tools and techniques to gain access to Bitfinex’s network.” Once inside their network, Lichtenstein illegally approved more than 2,000 transactions via which 119,754 bitcoin were transferred from Bitfinex to a wallet under his control.
He is also accused of enlisting his wife to help him hide the trail of the cryptocurrency proceeds by using a variety of devious methods, including creating online accounts using false identities, converting some of the bitcoin into gold coins and other cryptoassets, and sending the money through mixing services.
Blockchain analytics company Chainalysis noted last month that a significant quantity of the illicit funds were transferred to the now-defunct darknet market AlphaBay, which it said was used as a mixer by inputting the stolen Bitcoin and withdrawing similar quantities.
The bitcoin was transmitted to other mixers and virtual currency exchanges (VCEs) after AlphaBay was shut down by law officials. A portion of the digital assets was then converted to fiat cash and transferred to a U.S. bank account in 2020 and 2021.
The pair then used the bitcoin that was previously moved to the exchange to buy gift cards for Walmart and other businesses at another VCE (referred to as VCE 10 in court filings), which provided a specialised service dedicated to trading cryptocurrency for gift cards.
In the end, the gift card purchases mentioned above helped the inquiry by providing important information, according to Chainalysis.
“After tracking the first bitcoin transfers, detectives found that the account at VCE 10 used to buy gift cards was funded by a personal wallet address with the prefix 36B6mu, which had received more than $1 million in Bitcoin related to the Bitfinex hack.
The investigation also discovered that the Walmart gift card in particular was used on the retailer’s iPhone app under a Morgan-owned account, which allowed law enforcement to get a search warrant for the couple’s residence and cloud storage accounts.
The latter turned out to be a major break, as it led to the discovery of files containing details of the cryptocurrency addresses used to move the stolen funds, including their private keys, along with the fraudulent information used to open accounts at various crypto exchanges and their plans to acquire fake passports.
Lichtenstein, a Russian national, faces a maximum penalty of 20 years in prison, with Morgan, who pleaded guilty to one count of money laundering conspiracy and one count of conspiracy to defraud the U.S., awaiting a maximum jail term of 10 years.