Lichtenstein and Morgan: The Stolen Virtual Currency Laundry

If you’ve been scratching your head while you read about the money laundering escapades of Ilya Lichtenstein and his wife Heather Morgan, let me assure you that you are not alone. The Department of Justice told us that this duo created a “labyrinth of cryptocurrency transactions” in their attempts to launder the proceeds from the 119,574 stolen cryptocurrency tokens obtained via the hack of the Bitfinex platform in 2016.

The DoJ noted that while the duo laundered approximately 25,000 of those bitcoins and turned the virtual currency into cash, the FBI and their law enforcement partners successfully recovered and seized 94,000 more bitcoins from Lichtenstein and Morgan. For those doing the math, the 119,574 bitcoins stolen in 2016 had a value of $72 million; the present value of those same bitcoins has an approximate value of $4.5 billion.

Lichenstein and Morgan

Social media is buzzing over the 2016 theft and the subsequent money laundering associated with Lichtenstein and Morgan. It seemed no one had this particular revelation on their 2022 cryptocurrency theft scorecard. The pair’s social media profiles provided little indication of their nefarious activities. For example, Heather Morgan’s LinkedIn account showed her to be something of a polyglot with perhaps some business acumen. On other platforms, she presented herself as a bit of a gadfly, as evidenced by her video posts. Ilya “Dutch” Lichtenstein, a dual citizen of Russia and the United States, described himself as, in his own words, the ‘Crocodile of Wall Street.’

The court documents shared by the DoJ included an impressive amount of detail about the investigative efforts which went into unwinding the very long daisy-chain of transactions that Lichtenstein and Morgan undertook to try to obfuscate and derail any investigation. Say what you will about their personas, they were very good at creating false leads and dead ends as they successfully moved the virtual currency. The investigators found that the couple created fake identities, used automated techniques to accelerate transactions as a means to obfuscate and spread out the stolen cash across geographic regions and virtual accounts. They worked diligently to keep the trail leading to their cache of bitcoin secret and secure.

Follow the Money

It was, the court documents tell us, the investigating team’s ability to break the encryption which protected Lichtenstein’s “files [that] contained the private keys required to access the digital wallet that directly received the funds stolen from Bitfinex, and allowed special agents to lawfully seize and recover more than 94,000 bitcoin that had been stolen from Bitfinex.”

The Justice Department had quite a lot to say about these efforts. Deputy Attorney General Lisa O. Monaco stated, “Today’s arrests, and the department’s largest financial seizure ever, show that cryptocurrency is not a safe haven for criminals. In a futile effort to maintain digital anonymity, the defendants laundered stolen funds through a labyrinth of cryptocurrency transactions. Thanks to the meticulous work of law enforcement, the department once again showed how it can and will follow the money, no matter what form it takes.”

Over at the Internal Revenue Service, which was also involved in the investigation, Jim Lee, chief of the IRS Criminal Investigation unit, wished to highlight the work of his special agents. “IRS-CI Cyber Crimes Unit special agents have once again unraveled a sophisticated laundering technique, enabling them to trace, access and seize the stolen funds, which has amounted to the largest cryptocurrency seizure to date, valued at more than $3.6 billion,” Lee said.

At the end of the day, it wasn’t a flaw in a given cryptocurrency system that opened the doors for investigators; it was old-fashioned investigative work and the dogged determination of investigators. They simply followed the money. Lichtenstein’s own need to maintain supporting documents to keep his maze orderly and straight for himself while creating confusion for those attempting to untie his Gordian Knot proved to be the couple’s undoing.

Christopher Burgess

Christopher Burgess (@burgessct) is a writer, speaker and commentator on security issues. He is a former Senior Security Advisor to Cisco and served 30+ years within the CIA which awarded him the Distinguished Career Intelligence Medal upon his retirement. Christopher co-authored the book, “Secrets Stolen, Fortunes Lost, Preventing Intellectual Property Theft and Economic Espionage in the 21st Century”. He also founded the non-profit: Senior Online Safety.

burgesschristopher has 186 posts and counting.See all posts by burgesschristopher