In this lesson
- find out how about 120,000 bitcoins were stolen from Bitfinex in 2016 and how the exchange shared the loss
- understand why stolen bitcoins are hard to spend – and how investigators followed them for six years
- learn what this case teaches you about keeping coins on an exchange
What happened in the Bitfinex hack? On 2 August 2016 a hacker stole about 120,000 BTC (about 72 million dollars at the time) from the Hong Kong exchange Bitfinex. In February 2022 US agents arrested Ilya Lichtenstein and his wife Heather Morgan in New York and seized about 94,000 of the stolen bitcoins, worth about 3.6 billion dollars at the time. Both pleaded guilty; Lichtenstein admitted he was the hacker and got five years in prison in November 2024, Morgan 18 months.
Most hacks end with the money vanishing into the internet forever. This one ended with a startup founder, a self-styled rapper called "Razzlekhan", a video about being the "crocodile of Wall Street" and a cloud folder with a very unfortunate file in it. Netflix made a documentary about it. Of course it did.
Timeline#
| Date | What happened |
|---|---|
| 2 August 2016 | a hacker breaks into Bitfinex and makes over 2,000 unauthorised transfers: about 120,000 BTC are gone |
| August 2016 | Bitfinex cuts every customer balance by about 36% and hands out BFX tokens as IOUs |
| April 2017 | Bitfinex says it has redeemed all BFX tokens |
| 2017–2021 | small parts of the loot move through darknet markets, mixers and other exchanges |
| 8 February 2022 | Lichtenstein and Morgan are arrested; about 94,000 BTC are seized |
| August 2023 | both plead guilty; Lichtenstein admits he carried out the hack |
| November 2024 | Lichtenstein is sentenced to 5 years, Morgan to 18 months |
| January 2025 | the US government backs returning the recovered bitcoins to Bitfinex |
| 2025 | Morgan is released |
| Dec 2025 – Jan 2026 | Lichtenstein leaves prison early under the First Step Act and finishes his sentence under supervision |
How did Bitfinex share the loss?#
Bitfinex did not go bankrupt. Instead it did something unusual: it cut every customer's balance by about 36%, even for customers whose coins were not in the hacked wallets. For every lost dollar, customers received one BFX token – an IOU that the exchange promised to buy back. Bitfinex said it redeemed all of them by April 2017.
It was a creative rescue, but look at it from the customer's side: one morning a third of your money was gone because of someone else's hack, and you had no say in it. That is what "your coins on an exchange" means in practice – the exchange decides.
Why are stolen bitcoins so hard to spend?#
The blockchain is public. Every transfer of the stolen coins is visible forever, so the thief cannot simply send 120,000 BTC to an exchange and cash out. According to prosecutors, Lichtenstein spent years trying to break the trail:
- moving coins through thousands of new addresses in small amounts,
- using fake identities to open exchange accounts,
- passing coins through the darknet market AlphaBay and mixing services, which pool coins from many users to hide where they came from,
- swapping bitcoin for other cryptocurrencies ("chain hopping"),
- and turning some of it into gold coins – which, according to prosecutors, Morgan buried.
It did not work. Investigators followed the money on the blockchain for years, and in 2022 they found a file in Lichtenstein's cloud storage account with the private keys to the wallet holding most of the loot. Six years of laundering, undone by one file in the cloud.
What happened next?#
Both pleaded guilty in August 2023 – Lichtenstein to a money-laundering conspiracy, Morgan to money laundering and conspiracy to defraud the United States. In November 2024 the court in Washington sentenced Lichtenstein to five years and Morgan to 18 months.
As of October 2026, both are free. Morgan was released in 2025. Lichtenstein left prison around the turn of 2025 and 2026 under the First Step Act, a 2018 US law that lets inmates shorten their time through rehabilitation programmes, and serves the rest of his sentence under supervision. An early release is not a pardon: the convictions stand.
The 94,000 recovered bitcoins were worth about 3.6 billion dollars when they were seized – fifty times the value at the time of the hack. In January 2025 the US government sided with Bitfinex that the coins should go back to the exchange, and the court proceedings on returning them followed.
Warning signs you could have seen#
- A hot wallet holding a fortune. Bitfinex kept customer coins in wallets connected to the internet. The more an exchange keeps online, the bigger the prize for an attacker.
- "Your" coins can be cut by the exchange. The 36% haircut hit customers who were not even hacked. Read the terms: on most exchanges you are an unsecured creditor.
- Being big does not mean being safe. Bitfinex was one of the largest exchanges in the world in 2016.
- For investors: an influencer lifestyle is not a business plan. Morgan's company and rap videos looked like a harmless startup life. In hindsight, nobody asked where the money came from.
A hack can take your coins even if you did nothing wrong
Your password and two-factor authentication protect your account, not the exchange's wallets. When an exchange is hacked, every customer can lose – sometimes all of their balance, sometimes a share decided by the exchange. Keep long-term savings in a wallet where only you hold the keys.
How to do that safely is explained in the course on safe custody, for example in how a hardware wallet works.
Common myths#
- "Stolen bitcoin is untraceable." The opposite is true: every transfer stays on the blockchain forever, and investigators can wait years.
- "Mixers make coins clean." They make tracking harder, not impossible – and using them to hide stolen money is a crime in itself.
- "The hackers were caught, so the customers got their money back." Bitfinex had already covered the loss in 2016–2017 with BFX tokens; the recovered coins go back to the exchange, which decided how to treat its token holders.
Summary
- In August 2016 about 120,000 BTC were stolen from Bitfinex; the exchange cut every balance by about 36% and issued BFX tokens.
- In 2022 the FBI arrested Ilya Lichtenstein and Heather Morgan and seized about 94,000 BTC, then worth 3.6 billion dollars.
- Lichtenstein got 5 years and Morgan 18 months; as of October 2026 both are out of prison.
- The blockchain never forgets – but an exchange's hot wallet can still be emptied in one night.
Sources#
- US Department of Justice – two arrested, 3.6 billion dollars in stolen crypto seized (2022) (opens in a new tab)
- CyberScoop – Lichtenstein released early under the First Step Act (2026) (opens in a new tab)
- CoinDesk – Lichtenstein credits the First Step Act for his early release (2026) (opens in a new tab)