In August 2016, the cryptocurrency exchange Bitfinex was hacked, with nearly 120,000 Bitcoin being transferred to a single wallet. This was worth around $72 million at the time, but would now be valued at over $5 billion! To account for the loss, Bitfinex controversially slashed the balance of every single account on the exchange by 36%, even those that contained no bitcoin at all.
Last week, the US Department of Justice (DoJ) announced the recovery of over 94,000 Bitcoin from the hack. With a current market value over $3.5 billion, this represents the DoJ’s largest ever recovery of stolen goods. A married couple from New York, Ilya Lichenstein and Heather Morgan, have been charged with conspiracy to commit money laundering and conspiracy to defraud the United States.
The Recovery Trail
In January 2017, small amounts of Bitcoin started to exit the hacker’s wallet. The DoJ describe this happening in “a series of small, complex transactions across multiple accounts and platforms”. Court filings reveal numerous methods used to cover the trail, including use of privacy coins such as Monero, dark-web marketplaces including Alphabay, and multiple fictitious identities on mainstream crypto exchanges.
After trawling through thousands of transactions, officials were eventually able to link wallet activity to the names Ilya Lichenstein and Heather Morgan. The couple were both publicly known as serial tech entrepreneurs, with Morgan appearing as a writer in several high-profile publications including Forbes. It wasn’t just the worlds of tech and journalism the pair dabbled in: Morgan also moonlighted as a rapper using the alter-ego ‘RAZZLEKHAN’, describing her style as “sexy horror comedy”.
Once a link to the pair was established, law enforcement moved in. A warrant was gained to access the cloud storage account of Lichenstein, where officials were able to decrypt a document containing the private keys to over 2,000 wallets linked to the hack—including the original wallet containing the remaining 94,636 bitcoin!
Lichenstein and Morgan appeared in federal court on Tuesday, and were denied bail on the grounds of posing a significant flight risk. Lisa O. Monaco, Deputy Attorney General, stated that this case demonstrates the ability of law enforcement agencies to follow money through the blockchain, and proves “cryptocurrency is not a safe haven for criminals”.
Next Steps
The DOJ plans to establish a court process for victims to reclaim stolen funds, however re-distribution of the recovered bounty is more complex than meets the eye, as Bitfinex claim to have already fully compensated those affected. Shortly after the hack, Bitfinex credited all account holders with the newly minted $BFX token, at a ratio of one token per dollar lost in the hack. Within 8 months, all of these tokens had been redeemed for their fiat value, or exchanged for capital stock of Bitfinex’s parent company, iFinex. Those that exchanged their tokens for stock were also issued with ‘recovery rights tokens’ ($RRT). Each $RRT token was assured to be redeemable for one US dollar in the event that the hacked funds were recovered.
Bitfinex have released a statement claiming they will work with the government to establish their rights to the stolen Bitcoin. Alongside buying back all $RRT tokens, they plan to use 80% of the recovered funds to reward holders of their $LEO token, which launched in 2019 to raise funds for the exchange. Given the exponential rise in the price of Bitcoin since 2016, many of those affected by the hack are aggrieved by the Bitfinex plan, and feel they should be entitled to a share of the rewards at current market rates. Several law firms state they have been contacted by victims of the hack, and are preparing legal action to lay claim to the recovered funds.
This battle is likely to carry on for a long time, with no easy resolution and little precedence to inform these decisions. The phrase ‘not your keys, not your crypto’ rings true…
