U.S. Seizes $3.6 Billion in Bitcoin Stolen in 2016 Hack

Ilya Lichtenstein, 34 years old, and his wife, Heather Morgan, 31, were both arrested without incident Tuesday morning in Manhattan, the department said. They have promoted themselves on social media as entrepreneurs with deep knowledge of tech and a love of travel.

According to court documents, the suspects allegedly conspired to launder nearly 120,000 bitcoin stolen from Bitfinex’s platform in 2016 after a hacker breached the exchange’s systems and initiated more than 2,000 unauthorized transactions. The transactions included the use of computer programs to rapidly automate bitcoin movements and deposits to try to conceal their origin, with some of the funds eventually landing in financial accounts tied to the couple, federal prosecutors said.

“Today’s arrests, and the department’s largest financial seizure ever, show that cryptocurrency is not a safe haven for criminals,” said Deputy Attorney General Lisa Monaco. “In a futile effort to maintain digital anonymity, the defendants laundered stolen funds through a labyrinth of cryptocurrency transactions.”

At the couple’s appearance in Manhattan court Tuesday, U.S. Magistrate Judge Debra Freeman set bond at $5 million for Mr. Lichtenstein and $3 million for Ms. Morgan, requiring that their parents’ homes be posted as security. The judge also ordered that they not have devices with internet access and prohibited them from conducting cryptocurrency transactions.

Anirudh Bansal, a lawyer for Mr. Lichtenstein and Ms. Morgan, told the judge that his clients had been aware of the government’s investigation since November and hadn’t tried to flee the country. Mr. Bansal declined to comment further.

Mr. Lichtenstein and Ms. Morgan face charges relating to conspiracy to commit money laundering and conspiracy to defraud the U.S. They weren’t charged with carrying out the hack of Bitfinex. The Justice Department’s investigation is ongoing, officials said.

Hong Kong-based digital-currency exchange Bitfinex said it was hacked in 2016, causing the price of bitcoin to sharply drop. At the time, the value of the stolen bitcoin was valued at around $70 million, officials said.

Bitcoin, like many virtual currencies, can fluctuate wildly in price and has soared enormously since 2016. The $3.6 billion recovered by the Justice Department is the value of the bitcoin at the time of seizure, which occurred last week, officials said. Overall the current value of the stolen bitcoin linked to the hack is valued today at about $4.5 billion, officials said, but only about 94,000 of the roughly 119,754 stolen bitcoin were recovered.

Bitcoin is a popular type of so-called cryptocurrency, a kind of digital currency that exists as open-source computer code and that is maintained by the operations of a vast world-wide network of computers. Officials said the fact that blockchain—the inalterable ledger that records bitcoin transactions—is public was helpful in their investigation.

Ari Redbord, a former senior Treasury Department official now at the blockchain analytics firm TRM Labs, said the arrests show the developing capabilities of investigators to trace cryptocurrency flows, including years after illicit transactions occurred.

“As the obfuscation techniques evolve, so do the tools authorities have to track them,” said Mr. Redbord. “The blockchain is forever.”

The case also helps law enforcement understand the strategies hackers, terrorists and other criminals are using in digital-currency markets to try to move illicit funds, he said.

The Justice Department created a National Cryptocurrency Enforcement Team last October to prosecute criminals that rely on cryptocurrency and recover illicit proceeds.

Last year, authorities were able to claw back about $2.3 million in bitcoin that was paid by Colonial Pipeline Co. to a Russian ransomware gang that hacked the major conduit, causing a shutdown that lasted for days on the pipeline that runs from the Gulf Coast to New Jersey.

The couple arrested Tuesday, Mr. Lichtenstein and Ms. Morgan, allegedly used their laundered proceeds to purchase a variety of material goods and assets, including gold, nonfungible tokens and Walmart gift cards, officials said.

Only a small portion of the stolen money had been spent by the time of their arrest, according to officials.

Federal prosecutors unsuccessfully requested at Tuesday’s proceeding that the Ms. Morgan and Mr. Lichtenstein be held without bond, saying they were a flight risk.

During a search of the couple’s Manhattan home this month, federal agents found a bag of burner phones, $40,000 in cash and a device with an electronic file that had fake identities used to open bitcoin accounts, Assistant U.S. Attorney Maggie Lynaugh said. Another file found in the search, she said, had information on how to purchase passports on the dark web.

The couple is also believed to have access to $330 million in bitcoin that the federal government hasn’t located, Ms. Lynaugh said.

Ms. Morgan and Mr. Lichtenstein, who also goes by the nickname Dutch, have promoted themselves as veteran tech and crypto entrepreneurs, according to their social-media posts. Their enterprises include co-founding Demandpath, a venture-capital fund; Endpass, a cryptocurrency wallet; and SalesFolk, a marketing firm.

All three companies were used by the couple to justify some of their cryptocurrency transactions, Christopher Janczewski, special agent for the Internal Revenue Service’s criminal investigation division, said in a court filing.

On Medium, a publishing platform, Mr. Lichtenstein’s profile describes him as a “tech entrepreneur, explorer, and occasional magician.” His profile on LinkedIn, the professional networking platform, says he is a “coder and investor interested in blockchain technology, automation, and big data.”

Ms. Morgan’s profile on Forbes.com, where her articles are posted under the site’s ForbesWomen banner, says she is an international economist and serial entrepreneur specializing in software development.

“When she’s not reverse-engineering black markets to think of better ways to combat fraud and cybercrime, she enjoys rapping and designing streetwear fashion,” her Forbes.com bio reads. Her LinkedIn page links to a personal website, in which she refers to herself as rapper Razzlekhan, with a “fearless entrepreneurial spirit and hacker mindset.”

A friend of Ms. Morgan said the couple, while planning to buy a $2 million apartment in New York, didn’t live a lavish lifestyle and weren’t splashy spenders. The friend said their wedding in November was modest and the couple said they often used air miles to fly.

Bitfinex, the exchange platform that was hacked in 2016, said it had been cooperating with the Justice Department since its investigation began and said it would “follow appropriate legal processes to establish our rights to a return of the stolen bitcoin.” Updates on the return of stolen bitcoin would be forthcoming, the company said.

Some financial crime experts said the seizure and others in the past several years show that cryptocurrency markets can be increasingly monitored by law enforcement. Top law-enforcement officials whose agencies investigate cryptocurrency crimes, including the U.S. Secret Service, have said the blockchain ledger provides a digital trail for their probes, but have urged policy makers to strengthen reporting rules on the identities of users.

Corrections & Amplifications
Ari Redbord is a former senior Treasury Department official now at the blockchain analytics firm TRM Labs. An earlier version of this article incorrectly spelled his last name as Redboard. (Corrected on Feb. 8)

—James Fanelli contributed to this article.

Write to Dustin Volz at [email protected] and Ian Talley at [email protected]