{
  "id": "case-lichtenstein-bitfinex",
  "slug": "us-v-lichtenstein-bitfinex-heist-laundering",
  "title": "U.S. v. Ilya Lichtenstein & Heather Morgan (Bitfinex Hack & Laundering)",
  "summary": "Conviction of Ilya Lichtenstein and Heather Morgan for executing the 2016 hack of the Bitfinex virtual currency exchange, stealing 119,754 Bitcoins (valued at $4.5 billion at arrest), and laundering the funds through complex cryptocurrency mixers and darknet markets.",
  "case_number": "1:23-cr-00239",
  "court": "U.S. District Court for the District of Columbia",
  "district": "D.D.C.",
  "country": "United States",
  "opened_at": "2022-02-07",
  "status": "sentenced",
  "victim_sector": "Cryptocurrency Exchanges, Financial Services",
  "victim_country": "United States, Hong Kong",
  "loss_amount_usd": 4500000000,
  "loss_amount_note": "Stole 119,754 Bitcoins from Bitfinex; DOJ recovered 94,000 Bitcoins valued at $3.6 billion in the largest single financial seizure in U.S. history.",
  "first_seen_at": "2016-08-02T00:00:00Z",
  "last_updated_at": "2026-06-15T16:00:00Z",
  "actor_slug": "bitfinex-heist",
  "defendant_slugs": [
    "ilya-lichtenstein",
    "heather-morgan"
  ],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1078",
      "evidence_excerpt": "Lichtenstein gained access to Bitfinex's internal systems and authorized over 2,000 fraudulent cryptocurrency withdrawal transactions to private wallets.",
      "evidence_locator": "Statement of Offense \u00b6 6, Page 3",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "Statement of Offense: U.S. v. Lichtenstein",
      "source_url": "https://www.justice.gov/opa/pr/two-individuals-plead-guilty-money-laundering-conspiracies-connection-bitfinex-hack",
      "technique_name": "Valid Accounts",
      "tactic": "Defense Evasion"
    }
  ],
  "events": [
    {
      "event_type": "arrest",
      "event_date": "2022-02-08",
      "description": "Lichtenstein and Morgan arrested in Manhattan by federal agents with recovery of 94,000 Bitcoins."
    },
    {
      "event_type": "plea",
      "event_date": "2023-08-03",
      "description": "Defendants plead guilty to conspiracy to commit money laundering in D.D.C."
    },
    {
      "event_type": "sentencing",
      "event_date": "2024-11-14",
      "description": "Lichtenstein sentenced to 60 months (5 years) in federal prison; Morgan sentenced to 18 months."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Unauthorized intrusion originating from targeted infiltration directed against Cryptocurrency Exchanges, Financial Services networks. Conviction of Ilya Lichtenstein and Heather Morgan for executing the 2016 hack of the Bitfinex virtual currency exchange, stealing 119,754 Bitcoins (valued at $4.5 billion at arrest), and laundering the funds through complex cryptocurrency mixers and darknet markets.",
    "blast_radius": "Stole 119,754 Bitcoins from Bitfinex; DOJ recovered 94,000 Bitcoins valued at $3.6 billion in the largest single financial seizure in U.S. history. Impacted Cryptocurrency Exchanges, Financial Services infrastructure and associated victim operations.",
    "kill_chain": [
      {
        "phase": "Phase 1: Defense Evasion",
        "title": "Defense Evasion & Security Blindfolding",
        "description": "Lichtenstein gained access to Bitfinex's internal systems and authorized over 2,000 fraudulent cryptocurrency withdrawal transactions to private wallets.",
        "technical_artifacts": [
          "T1078",
          "Valid Accounts"
        ],
        "mitre_technique_id": "T1078"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across all external remote access endpoints.",
      "Implement network microsegmentation to prevent unrestricted lateral traversal between internal subnets.",
      "Maintain isolated, immutable backups of critical directory services and transaction databases.",
      "Deploy real-time endpoint detection and response (EDR) agents with automated containment policies."
    ]
  }
}