Justice Department Says It Seized $3.6 Billion Worth of Bitcoin Stolen in 2016 Hack

Ilya Lichtenstein, 34 years old, and his wife, Heather Morgan, 31, were both arrested without incident Tuesday morning in Manhattan, the department said. They have promoted themselves on social media as entrepreneurs with deep knowledge of tech and a love of travel. They are scheduled to make their initial court appearances Tuesday afternoon.

According to court documents, the suspects allegedly conspired to launder nearly 120,000 bitcoin stolen from Bitfinex’s platform in 2016 after a hacker breached the exchange’s systems and initiated more than 2,000 unauthorized transactions. The transactions funneled the stolen bitcoin to a digital wallet being controlled by Mr. Lichtenstein, federal prosecutors said.

“Today’s arrests, and the department’s largest financial seizure ever, show that cryptocurrency is not a safe haven for criminals,” said Deputy Attorney General Lisa Monaco. “In a futile effort to maintain digital anonymity, the defendants laundered stolen funds through a labyrinth of cryptocurrency transactions.”

Mr. Lichtenstein and Ms. Morgan face charges relating to conspiracy to commit money laundering and conspiracy to defraud the U.S. They weren’t charged with carrying out the hack of Bitfinex. The Justice Department’s investigation is ongoing, officials said.

Mr. Lichtenstein didn’t respond to a request for comment sent to two email addresses linked to him. Ms. Morgan didn’t immediately respond to a request for comment sent to her page on the LinkedIn platform.

Hong Kong-based digital-currency exchange Bitfinex said it was hacked in 2016, causing the price of bitcoin to sharply drop. At the time, the value of the stolen bitcoin was valued at around $70 million, officials said.

Bitcoin, like many virtual currencies, can fluctuate wildly in price and has soared enormously since 2016. The $3.6 billion recovered by the Justice Department is the value of the bitcoin at the time of seizure, which occurred last week, officials said. Overall the current value of the stolen bitcoin linked to the hack is valued today at about $4.5 billion, officials said, but only about 94,000 of the roughly 119,754 stolen bitcoin were recovered.

Bitcoin is a popular type of so-called cryptocurrency, a kind of digital currency that exists as open-source computer code and that is maintained by the operations of a vast world-wide network of computers. Officials said the fact that blockchain—the inalterable ledger that records bitcoin transactions—is public was helpful in their investigation.

Ari Redbord, a former senior Treasury Department official now at the blockchain analytics firm TRM Labs, said the arrests show the developing capabilities of investigators to trace cryptocurrency flows, including years after illicit transactions occurred.

“As the obfuscation techniques evolve, so do the tools authorities have to track them,” said Mr. Redbord. “The blockchain is forever.”

The case also helps law enforcement understand the strategies hackers, terrorists and other criminals are using in digital-currency markets to try to move illicit funds, he said.

The Justice Department created a National Cryptocurrency Enforcement Team last October to prosecute criminals that rely on cryptocurrency and recover illicit proceeds.

Last year, authorities were able to claw back about $2.3 million in bitcoin that was paid by Colonial Pipeline Co. to a Russian ransomware gang that hacked the major conduit, causing a shutdown that lasted for days on the pipeline that runs from the Gulf Coast to New Jersey.

The couple arrested Tuesday, Mr. Lichtenstein and Ms. Morgan, allegedly used their laundered proceeds to purchase a variety of material goods and assets, including gold, nonfungible tokens and Walmart gift cards, officials said.

Ms. Morgan and Mr. Lichtenstein, who also goes by the nickname Dutch, have promoted themselves as veteran tech and crypto entrepreneurs, according to their social-media posts. Their enterprises include co-founding Demandpath, a venture-capital fund, and Endpass, a cryptocurrency wallet.

On Medium, a publishing platform, Mr. Lichtenstein’s profile describes him as a “tech entrepreneur, explorer, and occasional magician.” His profile on LinkedIn, the professional networking platform, says he is a “coder and investor interested in blockchain technology, automation, and big data.”

Ms. Morgan’s profile on Forbes.com, where her articles are posted under the site’s ForbesWomen banner, says she is an international economist and serial entrepreneur specializing in software development.

“When she’s not reverse-engineering black markets to think of better ways to combat fraud and cybercrime, she enjoys rapping and designing streetwear fashion,” her Forbes.com bio reads. Her LinkedIn page links to a personal website, in which she refers to herself as rapper Razzlekhan, with a “fearless entrepreneurial spirit and hacker mindset.”

Bitfinex, the exchange platform that was hacked in 2016, said it had been cooperating with the Justice Department since its investigation began and said it would “follow appropriate legal processes to establish our rights to a return of the stolen bitcoin.” Updates on the return of stolen bitcoin would be forthcoming, the company said.

Some financial crime experts said the seizure and others in the past several years show that cryptocurrency markets can be increasingly monitored by law enforcement. Top law-enforcement officials whose agencies investigate cryptocurrency crimes, including the U.S. Secret Service, have said the blockchain ledger provides a digital trail for their probes, but have urged policy makers to strengthen reporting rules on the identities of users.

Corrections & Amplifications
Ari Redbord is a former senior Treasury Department official now at the blockchain analytics firm TRM Labs. An earlier version of this article incorrectly spelled his last name as Redboard. (Corrected on Feb. 8)

Write to Dustin Volz at [email protected] and Ian Talley at [email protected]