PRIMARY SOURCE DB
MITRE ATT&CK v15.1
Page built 2026-09-29
Data as of September 28, 2026 at 20:45 UTC
Search
CASE DOSSIER sentenced

U.S. v. Ilya Lichtenstein & Heather Morgan (Bitfinex Hack & Laundering)

Docket: 1:23-cr-00239 Court: U.S. District Court for the District of Columbia Opened: 2022-02-07 Sector: Cryptocurrency Exchanges, Financial Services

Key Facts

Status
SENTENCED
Legal disposition
Loss Amount
$4.5 billion
Stole 119,754 Bitcoins from Bitfinex; DOJ recovered 94,000 Bitcoins valued at $3.6 billion in the largest single financial seizure in U.S. history.
Techniques
1
Verified mappings
Defendants
2
Named in charges
  • Legal Status: SENTENCED in U.S. District Court for the District of Columbia.
  • Primary Target Sector: Cryptocurrency Exchanges, Financial Services.
  • Documented Financial Loss: $4.5 billion.
  • 1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Export structured case data and MITRE ATT&CK Navigator layer:
Download Navigator Layer (JSON) Case Data (JSON)

Case Summary

Conviction of Ilya Lichtenstein and Heather Morgan for executing the 2016 hack of the Bitfinex virtual currency exchange, stealing 119,754 Bitcoins (valued at $4.5 billion at arrest), and laundering the funds through complex cryptocurrency mixers and darknet markets.
BOARDROOM EXECUTIVE BRIEF

Executive Summary for Board Members & Leadership

Plain-English Root Cause

Unauthorized intrusion originating from targeted infiltration directed against Cryptocurrency Exchanges, Financial Services networks. Conviction of Ilya Lichtenstein and Heather Morgan for executing the 2016 hack of the Bitfinex virtual currency exchange, stealing 119,754 Bitcoins (valued at $4.5 billion at arrest), and laundering the funds through complex cryptocurrency mixers and darknet markets.

Operational & Financial Fallout

Stole 119,754 Bitcoins from Bitfinex; DOJ recovered 94,000 Bitcoins valued at $3.6 billion in the largest single financial seizure in U.S. history. Impacted Cryptocurrency Exchanges, Financial Services infrastructure and associated victim operations.

3 Critical Boardroom Questions

  • 1. Do 100% of our external portals enforce phishing-resistant hardware MFA?
  • 2. Can compromised endpoint credentials traverse laterally to domain controllers or cloud storage?
  • 3. Have our air-gapped immutable recovery backups been restored and tested within the last 90 days?
Disposition: SENTENCED
Technical Threat Intelligence

Attack Anatomy & Incident Execution

Forensic analysis of initial intrusion vector, step-by-step kill chain, operational blast radius, and defensive controls.

Ground Zero / Infiltration Vector

Unauthorized intrusion originating from targeted infiltration directed against Cryptocurrency Exchanges, Financial Services networks. Conviction of Ilya Lichtenstein and Heather Morgan for executing the 2016 hack of the Bitfinex virtual currency exchange, stealing 119,754 Bitcoins (valued at $4.5 billion at arrest), and laundering the funds through complex cryptocurrency mixers and darknet markets.

Adversary Kill Chain Flow

1 Documented Phases
1
Phase 1: Defense Evasion Defense Evasion & Security Blindfolding
MITRE ATT&CK T1078 →

Lichtenstein gained access to Bitfinex's internal systems and authorized over 2,000 fraudulent cryptocurrency withdrawal transactions to private wallets.

Artifacts & Tooling: T1078 Valid Accounts
Real-World Blast Radius & Operational Fallout

Stole 119,754 Bitcoins from Bitfinex; DOJ recovered 94,000 Bitcoins valued at $3.6 billion in the largest single financial seizure in U.S. history. Impacted Cryptocurrency Exchanges, Financial Services infrastructure and associated victim operations.

Defensive Engineering Takeaways
Recommended Hardening Controls
✓ Enforce phishing-resistant multifactor authentication (FIDO2) across all external remote access endpoints.
✓ Implement network microsegmentation to prevent unrestricted lateral traversal between internal subnets.
✓ Maintain isolated, immutable backups of critical directory services and transaction databases.
✓ Deploy real-time endpoint detection and response (EDR) agents with automated containment policies.

Procedural & Incident Timeline

2022-02-08 arrest

Lichtenstein and Morgan arrested in Manhattan by federal agents with recovery of 94,000 Bitcoins.

2023-08-03 plea

Defendants plead guilty to conspiracy to commit money laundering in D.D.C.

2024-11-14 sentencing

Lichtenstein sentenced to 60 months (5 years) in federal prison; Morgan sentenced to 18 months.

Named Defendants & Operatives

Defendant Nationality Status Prison Term Restitution Notes
Ilya Lichtenstein United States sentenced 60 mo None Perpetrator of 2016 Bitfinex exchange intrusion; sentenced to 60 months in prison.
Heather Rhiannon Morgan United States sentenced 18 mo None Conspirator in laundering 119,754 Bitcoins stolen from Bitfinex; sentenced to 18 months.

Substantiated MITRE ATT&CK Techniques

Technique ID Technique Name & Tactic Primary Source Evidence Excerpt Locator Verification
T1078 Valid Accounts
Defense Evasion
 "Lichtenstein gained access to Bitfinex's internal systems and authorized over 2,000 fraudulent cryptocurrency withdrawal transactions to private wallets." Statement of Offense ¶ 6, Page 3 reviewed

Cite & Embed This Case Record

Public Domain / CC0
Bluebook Legal Citation:
Cyberattack Case Library, U.S. v. Ilya Lichtenstein & Heather Morgan (Bitfinex Hack & Laundering), No. 1:23-cr-00239 (U.S. District Court for the District of Columbia 2022), https://cybercaselibrary.com/cases/us-v-lichtenstein-bitfinex-heist-laundering/
Embeddable Incident Card (HTML):
<iframe src="https://cybercaselibrary.com/embed/case/us-v-lichtenstein-bitfinex-heist-laundering" width="100%" height="220" style="border:none; border-radius:6px;" loading="lazy"></iframe>