Verify a decision

{"actor":"system:backfill","investigation_id":"89ad7c40-67d4-4e29-a139-c8b72398a53d","kind":"publish","page_slug":"bitfinex-hack-2016","published_at":"2026-06-01T17:47:14.842Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Bitfinex Hack 2016","sections":[{"content":"On August 2, 2016, Ilya Lichtenstein exploited critical vulnerabilities in Bitfinex's operational security to initiate approximately 2,000 unauthorized withdrawal transactions totaling 119,756 BTC — worth roughly $72 million at the time — to a wallet under his control. Bitfinex operated a multi-signature wallet system in partnership with digital security firm BitGo, using a 2-of-3 key arrangement whereby Bitfinex held two keys (one offline) and BitGo held the third as co-signer. A confidential post-incident report by Canadian consultancy Ledger Labs, commissioned by iFinex (Bitfinex's parent company) but never publicly released, found that Bitfinex had placed two of the three required security keys on the same server or device, creating a single point of failure. Once Lichtenstein gained access to that server, he obtained administrative tokens that allowed him to raise per-transaction withdrawal limits and bypass BitGo's co-signing approval process — draining nearly one-sixth of the exchange's monthly trading volume in under a minute. Bitfinex also failed to implement a withdrawal whitelist (restricting sends to pre-approved addresses) and lacked off-server activity logging, both of which BitGo had reportedly recommended. Bitcoin's price fell approximately 20% in the immediate aftermath of the announcement.","heading":"The August 2016 Breach","severity":"critical","sources":[{"credibility":2,"name":"2016 Bitfinex hack — Wikipedia","type":"news_article","url":"https://en.wikipedia.org/wiki/2016_Bitfinex_hack"},{"credibility":1,"name":"Confidential Report Flags Bitfinex Security Lapses in Huge 2016 Hack — OCCRP","type":"news_article","url":"https://www.occrp.org/en/feature/confidential-report-flags-bitfinex-security-lapses-in-huge-2016-hack"},{"credibility":2,"name":"The Bitfinex Bitcoin Hack: What We Know (And Don't Know) — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2016/08/03/the-bitfinex-bitcoin-hack-what-we-know-and-dont-know"},{"credibility":2,"name":"What the Bitfinex Hack Means for Bitcoin Multi-Sig Security — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2016/08/05/what-the-bitfinex-hack-means-for-bitcoin-multi-sig-security"}]},{"content":"Rather than isolating losses to the accounts that were directly breached, Bitfinex implemented a controversial 'generalized loss' policy on August 7, 2016: all customer balances — including those holding assets entirely unaffected by the hack — were reduced by a uniform 36.067%, reflecting the ratio of stolen funds to total exchange holdings. Users whose accounts had not been touched by the hack were required to absorb a proportional share of the losses alongside those directly affected. In compensation, Bitfinex issued BFX recovery tokens on a 1:1 USD basis, with each BFX token representing a $1 claim against Bitfinex. BFX tokens were initially tradeable on the Bitfinex platform and opened trading at roughly $0.30, implying significant market skepticism about full redemption. Bitfinex simultaneously created a mechanism for BFX holders to convert their tokens into equity shares of iFinex Inc., the exchange's parent company, alongside a second instrument — Recovery Right Tokens (RRTs) — granted as an incentive to those who chose the equity conversion. RRTs would entitle holders to a share of any future recovery of the stolen bitcoin. Bitfinex honored its BFX debt in full: on April 3, 2017, the exchange announced that all outstanding BFX tokens had been redeemed at $1.00 par value or converted to iFinex equity — approximately eight months after the hack.","heading":"Loss Socialization and BFX Token Scheme","severity":"high","sources":[{"credibility":2,"name":"100% Redemption of Outstanding BFX Tokens — Bitfinex Blog","type":"official","url":"https://blog.bitfinex.com/announcements/100-redemption-outstanding-bfx-tokens/"},{"credibility":2,"name":"2016 Bitfinex hack — Wikipedia","type":"news_article","url":"https://en.wikipedia.org/wiki/2016_Bitfinex_hack"},{"credibility":2,"name":"Bitfinex Recovery Right Tokens — Bitfinex Blog","type":"official","url":"https://blog.bitfinex.com/announcements/bitfinex-recovery-right-tokens/"},{"credibility":2,"name":"Bitfinex Makes Good on Debt, 100% of BFX Tokens Redeemed — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/bitfinex-bfx-tokens-redeemed/"}]},{"content":"On February 8, 2022, the U.S. Department of Justice announced the arrest of Ilya Lichtenstein, then 34, and his wife Heather Morgan, then 31, in New York City on charges of conspiracy to commit money laundering and conspiracy to defraud the United States. Simultaneously, federal law enforcement seized approximately 94,000 BTC — valued at approximately $3.6 billion at the time of seizure — marking the largest financial seizure in DOJ history up to that date. Investigators had traced the stolen funds through a complex laundering chain that included fictitious online accounts, automated transaction-splitting scripts, darknet market deposits, chain-hopping through multiple cryptocurrencies, and physical conversion into gold coins shipped to Lichtenstein's home address. Law enforcement obtained critical cloud storage service credentials via search warrant, recovering a file containing private keys and wallet addresses associated with the stolen funds. At the time of arrest, the total value of the approximately 119,754 BTC (including coins already dissipated through laundering) was estimated at approximately $4.5 billion. Morgan, who performed as a rapper under the pseudonym 'Razzlekhan' and wrote business columns as the 'Crocodile of Wall Street,' had played a supporting role in moving funds and establishing shell accounts.","heading":"DOJ Arrests and Record-Breaking Seizure (February 2022)","severity":"critical","sources":[{"credibility":1,"name":"Two Arrested for Alleged Conspiracy to Launder $4.5 Billion in Stolen Cryptocurrency — DOJ","type":"regulatory","url":"https://www.justice.gov/archives/opa/pr/two-arrested-alleged-conspiracy-launder-45-billion-stolen-cryptocurrency"},{"credibility":1,"name":"Feds seize $3.6 billion in bitcoin stolen from Bitfinex hack — CNBC","type":"news_article","url":"https://www.cnbc.com/2022/02/08/feds-seize-3point6-billion-stolen-from-bitfinex-hack.html"},{"credibility":1,"name":"DOJ Seizes $3.6 Billion in Bitcoin Stolen in Bitfinex Hack — Bloomberg","type":"news_article","url":"https://www.bloomberg.com/news/articles/2022-02-08/doj-seizes-3-6-billion-in-bitcoin-stolen-in-2016-bitfinex-hack"},{"credibility":1,"name":"Ilya Lichtenstein, Heather Morgan arrested in connection with bitcoin stolen from Bitfinex — Washington Post","type":"news_article","url":"https://www.washingtonpost.com/national-security/2022/02/08/bitfinex-hack-bitcoin-arrests/"},{"credibility":2,"name":"US Officials Seize $3.6B in Bitcoin From 2016 Bitfinex Hack — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2022/02/08/us-officials-seize-bitcoin-from-2016-bitfinex-hack"}]},{"content":"In August 2023, both Ilya Lichtenstein and Heather Morgan pleaded guilty to money laundering conspiracy before a federal court in Washington, D.C. Crucially, Lichtenstein also admitted at that time to being the original hacker who had breached Bitfinex's systems in 2016 — the first public confirmation of his direct role in the theft itself, not merely the laundering. On November 14, 2024, Lichtenstein was sentenced to 60 months (5 years) in federal prison; Morgan received 18 months. Both sentences were below the maximum applicable under the charges. Morgan was released after serving approximately 8 months. Lichtenstein was granted early release on January 2, 2026 — after serving roughly 14 months — under the First Step Act, a federal criminal justice reform law that permits sentence reductions for non-violent offenders demonstrating rehabilitation and good conduct. Lichtenstein publicly credited the law on social media, attributing his release to President Trump. A White House official confirmed he was placed on home confinement consistent with Bureau of Prisons policy.","heading":"Guilty Pleas and Sentencing","severity":"high","sources":[{"credibility":1,"name":"Husband and Wife Plead Guilty to Money Laundering Conspiracy — DOJ","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/husband-and-wife-plead-guilty-money-laundering-conspiracy-involving-hack-and-theft"},{"credibility":1,"name":"Bitcoin launderer pleads guilty, admits to massive Bitfinex hack — CNBC","type":"news_article","url":"https://www.cnbc.com/2023/08/03/new-york-man-admits-being-original-bitfinex-hacker-during-guilty-plea-in-dc-to-bitcoin-money-laundering.html"},{"credibility":2,"name":"Bitfinex Hacker Sentenced to 5 Years — The Hacker News","type":"news_article","url":"https://thehackernews.com/2024/11/bitfinex-hacker-sentenced-to-5-years.html"},{"credibility":2,"name":"Bitfinex hack convict Ilya Lichtenstein released early under First Step Act — The Hacker News","type":"news_article","url":"https://thehackernews.com/2026/01/bitfinex-hack-convict-ilya-lichtenstein.html"},{"credibility":2,"name":"Ilya Lichtenstein credits Trump's First Step Act for early release — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/01/02/crypto-hacker-ilya-lichtenstein-credits-trump-s-first-step-act-for-early-prison-release"},{"credibility":1,"name":"Bitfinex hacker Lichtenstein credits Trump for early release — TechCrunch","type":"news_article","url":"https://techcrunch.com/2026/01/03/bitfinex-hacker-ilya-lichtenstein-credits-trump-for-early-release-from-prison/"}]},{"content":"The approximately 94,000 BTC seized by the DOJ in February 2022 remained in government custody pending legal proceedings. By the time of the 2024 sentencing, the total government-recovered holdings from the Bitfinex hack were reported to be worth approximately $10 billion, reflecting Bitcoin's price appreciation since the 2022 seizure. In January 2025, a U.S. federal court ruled that Bitfinex and its users did not meet the technical criteria for 'victim' status under the Mandatory Victims Restitution Act, but the court invoked plea agreement provisions enabling voluntary restitution, ordering the return of approximately 94,000 BTC to Bitfinex in-kind. Bitfinex has contractual obligations to use recovered funds first to redeem outstanding Recovery Right Tokens (RRTs); approximately 30 million RRTs remain in circulation, and Bitfinex has stated the recovered amount may be insufficient to redeem all of them at full value. Under the terms of Bitfinex's LEO token offering, up to 80% of any remaining assets after RRT redemption would be distributed to holders of UNUS SED LEO (LEO) tokens over an 18-month period. A formal transfer of coins from government custody to Bitfinex had not been completed as of mid-2026.","heading":"Asset Recovery and Ongoing Restitution","severity":"medium","sources":[{"credibility":2,"name":"Court Orders $9 Billion Bitcoin Restitution in Bitfinex Hack Case — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/court-orders-9-billion-bitcoin-restitution-in-bitfinex-hack-case/"},{"credibility":2,"name":"Bitfinex Hack Update 2025: $9 Billion in Bitcoin to be Returned — BeInCrypto","type":"news_article","url":"https://beincrypto.com/bitfinex-hack-9-billion-bitcoin-recovery/"},{"credibility":2,"name":"Bitfinex deemed 'sole victim' eligible for recovery of $7.4 billion Bitcoin hack — CryptoSlate","type":"news_article","url":"https://cryptoslate.com/bitfinex-deemed-sole-victim-eligible-for-recovery-of-7-4-billion-bitcoin-hack/"},{"credibility":2,"name":"2016 Security Breach Bitcoin Recovery FAQ — Bitfinex Support","type":"official","url":"https://support.bitfinex.com/hc/en-us/articles/4417401349657-2016-Security-Breach-Bitcoin-Recovery-Frequently-Asked-Questions-FAQ"},{"credibility":2,"name":"Ilya Lichtenstein and Heather Morgan Sentenced — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/ilya-lichtenstein-sentenced-for-role-in-bitfinex-hack-in-razzlekhan-case-as-government-recovers-about-10-billion-in-stolen-funds"}]},{"content":"An investigative report by the Organized Crime and Corruption Reporting Project (OCCRP), published in May 2023, revealed the existence of a confidential post-hack forensic report commissioned by iFinex from Canadian cryptocurrency consultancy Ledger Labs. That report was never made public. According to OCCRP's findings, the Ledger Labs analysis concluded that Bitfinex had failed to implement multiple security controls recommended by BitGo, and that the co-location of keys on a single server — a decision attributable to Bitfinex's own operational choices — was the proximate cause of the breach. The analysis reportedly traced the originating IP addresses to Poland. Bitfinex disputed the Ledger Labs findings, characterizing the report as 'incomplete' and 'incorrect,' and pointed to alleged 'evidence of negligence on the part of other counterparties,' without specifying those counterparties publicly. BitGo maintained it was not at fault, a position Bitfinex publicly endorsed at the time of the breach.","heading":"Suppressed Security Audit and Bitfinex's Response","severity":"high","sources":[{"credibility":1,"name":"Confidential Report Flags Bitfinex Security Lapses in Huge 2016 Hack — OCCRP","type":"news_article","url":"https://www.occrp.org/en/feature/confidential-report-flags-bitfinex-security-lapses-in-huge-2016-hack"},{"credibility":2,"name":"2016 Crypto Hack: Bitfinex Hid a Report that Flagged Security Flaws — Finance Magnates","type":"news_article","url":"https://www.financemagnates.com/cryptocurrency/2016-crypto-hack-bitfinex-hid-a-report-that-flagged-security-flaws-occrp/"}]}],"sources_used":[{"name":"2016 Bitfinex hack — Wikipedia","type":"news_article","url":"https://en.wikipedia.org/wiki/2016_Bitfinex_hack"},{"name":"Two Arrested for Alleged Conspiracy to Launder $4.5 Billion in Stolen Cryptocurrency — DOJ","type":"regulatory","url":"https://www.justice.gov/archives/opa/pr/two-arrested-alleged-conspiracy-launder-45-billion-stolen-cryptocurrency"},{"name":"Husband and Wife Plead Guilty to Money Laundering Conspiracy — DOJ","type":"regulatory","url":"https://www.justice.gov/usao-dc/pr/husband-and-wife-plead-guilty-money-laundering-conspiracy-involving-hack-and-theft"},{"name":"Confidential Report Flags Bitfinex Security Lapses in Huge 2016 Hack — OCCRP","type":"news_article","url":"https://www.occrp.org/en/feature/confidential-report-flags-bitfinex-security-lapses-in-huge-2016-hack"},{"name":"Feds seize $3.6 billion in bitcoin stolen from Bitfinex hack — CNBC","type":"news_article","url":"https://www.cnbc.com/2022/02/08/feds-seize-3point6-billion-stolen-from-bitfinex-hack.html"},{"name":"DOJ Seizes $3.6 Billion in Bitcoin Stolen in Bitfinex Hack — Bloomberg","type":"news_article","url":"https://www.bloomberg.com/news/articles/2022-02-08/doj-seizes-3-6-billion-in-bitcoin-stolen-in-2016-bitfinex-hack"},{"name":"Bitcoin launderer pleads guilty, admits to massive Bitfinex hack — CNBC","type":"news_article","url":"https://www.cnbc.com/2023/08/03/new-york-man-admits-being-original-bitfinex-hacker-during-guilty-plea-in-dc-to-bitcoin-money-laundering.html"},{"name":"Bitfinex Hacker Sentenced to 5 Years — The Hacker News","type":"news_article","url":"https://thehackernews.com/2024/11/bitfinex-hacker-sentenced-to-5-years.html"},{"name":"Ilya Lichtenstein credits Trump's First Step Act for early release — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/01/02/crypto-hacker-ilya-lichtenstein-credits-trump-s-first-step-act-for-early-prison-release"},{"name":"100% Redemption of Outstanding BFX Tokens — Bitfinex Blog","type":"official","url":"https://blog.bitfinex.com/announcements/100-redemption-outstanding-bfx-tokens/"},{"name":"2016 Security Breach Bitcoin Recovery FAQ — Bitfinex Support","type":"official","url":"https://support.bitfinex.com/hc/en-us/articles/4417401349657-2016-Security-Breach-Bitcoin-Recovery-Frequently-Asked-Questions-FAQ"},{"name":"The Bitfinex Bitcoin Hack: What We Know (And Don't Know) — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2016/08/03/the-bitfinex-bitcoin-hack-what-we-know-and-dont-know"},{"name":"Bitfinex Hack Update 2025: $9 Billion in Bitcoin to be Returned — BeInCrypto","type":"news_article","url":"https://beincrypto.com/bitfinex-hack-9-billion-bitcoin-recovery/"},{"name":"Ilya Lichtenstein and Heather Morgan Sentenced — TRM Labs","type":"research","url":"https://www.trmlabs.com/resources/blog/ilya-lichtenstein-sentenced-for-role-in-bitfinex-hack-in-razzlekhan-case-as-government-recovers-about-10-billion-in-stolen-funds"},{"name":"Bitfinex hacker Lichtenstein credits Trump for early release — TechCrunch","type":"news_article","url":"https://techcrunch.com/2026/01/03/bitfinex-hacker-ilya-lichtenstein-credits-trump-for-early-release-from-prison/"},{"name":"Ilya Lichtenstein, Heather Morgan arrested — Washington Post","type":"news_article","url":"https://www.washingtonpost.com/national-security/2022/02/08/bitfinex-hack-bitcoin-arrests/"}],"summary":"On August 2, 2016, Bitfinex — a Hong Kong-based cryptocurrency exchange — was breached by hacker Ilya Lichtenstein, who exploited security failures in the exchange's multi-signature wallet architecture to steal 119,756 BTC (approximately $72 million at the time). Bitfinex controversially socialized the losses across all user accounts with a 36.067% haircut and issued BFX debt tokens, which were fully redeemed at par by April 2017. In February 2022, the U.S. Department of Justice arrested Lichtenstein and his wife Heather Morgan after seizing approximately 94,000 BTC worth $3.6 billion — the largest financial seizure in DOJ history at the time — and both subsequently pleaded guilty; Lichtenstein was sentenced to 5 years (released early in January 2026) and Morgan to 18 months.","timeline":[{"date":"2016-08-02","event":"Ilya Lichtenstein breaches Bitfinex's systems, executing approximately 2,000 unauthorized withdrawal transactions totaling 119,756 BTC (~$72 million) to a wallet under his control.","source":"DOJ press release / CNBC","source_url":"https://www.cnbc.com/2023/08/03/new-york-man-admits-being-original-bitfinex-hacker-during-guilty-plea-in-dc-to-bitcoin-money-laundering.html"},{"date":"2016-08-02","event":"Bitfinex halts all trading and withdrawals following discovery of the breach. Bitcoin price drops approximately 20%.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2016/08/03/the-bitfinex-bitcoin-hack-what-we-know-and-dont-know"},{"date":"2016-08-07","event":"Bitfinex implements a 36.067% 'generalized haircut' across all customer balances, issuing BFX debt tokens at a 1:1 USD ratio to compensate affected and non-affected users alike.","source":"Wikipedia / Coin Bureau","source_url":"https://en.wikipedia.org/wiki/2016_Bitfinex_hack"},{"date":"2017-04-03","event":"Bitfinex completes full redemption of all outstanding BFX tokens at $1.00 par value, approximately eight months after issuance.","source":"Bitfinex Blog","source_url":"https://blog.bitfinex.com/announcements/100-redemption-outstanding-bfx-tokens/"},{"date":"2022-02-08","event":"The U.S. Department of Justice arrests Ilya Lichtenstein and Heather Morgan in New York City and seizes approximately 94,000 BTC valued at ~$3.6 billion — the largest financial seizure in DOJ history at that time.","source":"DOJ press release","source_url":"https://www.justice.gov/archives/opa/pr/two-arrested-alleged-conspiracy-launder-45-billion-stolen-cryptocurrency"},{"date":"2023-05-01","event":"OCCRP publishes investigation revealing that Bitfinex commissioned — and withheld — a confidential Ledger Labs security report identifying critical failures that enabled the 2016 hack.","source":"OCCRP","source_url":"https://www.occrp.org/en/feature/confidential-report-flags-bitfinex-security-lapses-in-huge-2016-hack"},{"date":"2023-08-03","event":"Ilya Lichtenstein and Heather Morgan plead guilty to money laundering conspiracy in Washington D.C. federal court. Lichtenstein admits for the first time to committing the original 2016 hack.","source":"CNBC / DOJ","source_url":"https://www.cnbc.com/2023/08/03/new-york-man-admits-being-original-bitfinex-hacker-during-guilty-plea-in-dc-to-bitcoin-money-laundering.html"},{"date":"2024-11-14","event":"Ilya Lichtenstein sentenced to 60 months (5 years) in federal prison. Heather Morgan sentenced to 18 months.","source":"The Hacker News / Bank Info Security","source_url":"https://thehackernews.com/2024/11/bitfinex-hacker-sentenced-to-5-years.html"},{"date":"2025-01-01","event":"U.S. federal court orders in-kind restitution of approximately 94,000 BTC to Bitfinex via plea agreement provisions, after ruling Bitfinex does not qualify as a 'victim' under the Mandatory Victims Restitution Act.","source":"BeInCrypto / Bitcoin.com News","source_url":"https://beincrypto.com/bitfinex-hack-9-billion-bitcoin-recovery/"},{"date":"2026-01-02","event":"Ilya Lichtenstein released from federal prison after approximately 14 months, citing early release under the First Step Act. Placed on home confinement.","source":"CoinDesk / TechCrunch","source_url":"https://www.coindesk.com/tech/2026/01/02/crypto-hacker-ilya-lichtenstein-credits-trump-s-first-step-act-for-early-prison-release"}]},"v":1}