US accuses couple of laundering $4.5bn in bitcoin tied to 2016 hack

The U.S. Justice Department said on Tuesday it has unraveled its biggest-ever cryptocurrency theft, seizing a record-shattering $3.6 billion in bitcoin tied to the 2016 hack of digital currency exchange Bitfinex and arresting a husband-and-wife team on money laundering charges.

Ilya “Dutch” Lichtenstein, 34, and his wife, Heather Morgan, 31, New Yorkers who were arrested in Manhattan Tuesday morning, spent the illegal proceeds on items ranging from gold and non-fungible tokens to a $500 Walmart gift card, prosecutors said.

The couple had active public profiles, with Morgan known as rap singer “Razzlekhan,” a pseudonym that she said on her website referred to Genghis Khan “but with more pizzazz.”

It was the Justice Department’s biggest financial seizure, Deputy Attorney General Lisa Monaco said, adding in a statement that it shows cryptocurrency is “not a safe haven for criminals.”

Lichtenstein and Morgan face charges of conspiring to commit money laundering as well as to defraud the United States. The case was filed in a federal court in Washington, D.C.

At their initial appearances in federal court in Manhattan on Tuesday afternoon, U.S. Magistrate Judge Debra Freeman set bond at $5 million for Lichtenstein and $3 million for Morgan and demanded that their parents post their homes as security for their return to court.

The pair is accused of conspiring to launder 119,754 bitcoin stolen after a hacker broke into Bitfinex and initiated more than 2,000 unauthorized transactions. Justice Department officials said the transactions at the time were valued at $71 million in bitcoin, but with the rise in the currency’s value, the value now is over $4.5 billion.

A key clue may have come from the 2017 bust of an underground digital market used to launder a portion of the funds. U.S. officials said some of the money was transferred to AlphaBay, an anything-goes version of eBay hosted on the dark web.

When the site was taken down, it likely allowed authorities to access AlphaBay’s internal transaction logs and connect them to a cryptocurrency account in Lichtenstein’s name, according to digital currency tracking company Elliptic.

Bitfinex said in a statement it was working with the Department of Justice to “establish our rights to a return of the stolen bitcoin.”

‘Protect your business from cybercriminals’

Lichtenstein and Morgan also tried to launder money via a network of currency exchanges or claimed that the money represented payments to Morgan’s startup, the Department of Justice said.

In addition to her rap singer profile, Morgan had sidelines in the painting, fashion design, and writing worlds, where she pitched herself as a kind of corporate coach. One of her recent pieces was titled, in part, “Tips to Protect Your Business from Cybercriminals” and featured an interview with a cryptocurrency exchange owner about how to prevent fraud.

Morgan, wearing a white hoodie at her court appearance, frequently glanced back at her parents, who were seated in the audience of the courtroom. Both she and Lichtenstein, who holds dual U.S.-Russian citizenship, nodded as Freeman warned them of severe consequences if they tried to flee.

They will both be placed on house arrest, with electronic monitoring, and will be barred from engaging in cryptocurrency transactions pending trial, Freeman said. A judge in Washington, where further hearings will be held, could later set different conditions, she said.

Prosecutors sought to have both detained ahead of trial, arguing they posed a flight risk. But Freeman said she was swayed by defense lawyer Anirudh Bansal’s argument that both Lichtenstein and Morgan had known they were under investigation since November and nonetheless remained in the United States.

Tuesday’s criminal complaint came more than four months after Monaco announced the department was launching a new National Cryptocurrency Enforcement Team, which comprises a mix of anti-money laundering and cybersecurity experts.

Cyber criminals who attack companies, municipalities and individuals with ransomware often demand payment in cryptocurrency.

In one high-profile example last year, former partners and associates of the ransomware group REvil caused a widespread gas shortage on the U.S. East Coast when it used encryption software called DarkSide to launch a cyber attack on the Colonial Pipeline.

The Justice Department later recovered some $2.3 million in cryptocurrency ransom that Colonial paid to the hackers.

Cases like these demonstrate that the Justice Department “can follow money across the blockchain, just as we have always followed it within the traditional financial system,” said Kenneth Polite, assistant attorney general of the department’s Criminal Division.