Lichtenstein & Razzlekhan: The Bitfinex Bonnie & Clyde

On 8 February 2022 federal agents arrested a married couple in Manhattan. Ilya Lichtenstein, a tech entrepreneur in his early thirties who had co-founded the sales software company MixRank, and Heather Morgan, a business writer for Forbes and Inc. who rapped online as "Razzlekhan", were charged with conspiring to launder bitcoin stolen from the exchange Bitfinex in 2016. The same day the Justice Department announced it had seized about 94,000 of the stolen coins, then worth about $3.6 billion. At the time it was the largest financial seizure in the department's history.

The internet fixed on Morgan. Her music videos, in which she called herself the "Crocodile of Wall Street", went viral within hours. The more important fact took another 18 months to come out: Lichtenstein had not just laundered the money. He had stolen it.

The hack

Bitfinex, then one of the biggest crypto exchanges, works like an online broker for digital coins. In August 2016 someone got inside its systems and pushed through more than 2,000 unauthorised transactions, draining 119,754 bitcoin from customer wallets into one wallet controlled by the thief. The coins were worth about $71 million at the time. The price of bitcoin fell about 20 percent on the news.

Bitfinex did not close. It cut every customer's balance by 36 percent, including customers whose accounts had not been touched, and handed out IOU tokens for the losses, which it bought back in full by April 2017. It later issued Recovery Right Tokens, a claim on whatever might one day be recovered. The theft became one of the great unsolved cases in crypto, and the coins sat mostly still for years.

In August 2023, when Lichtenstein pleaded guilty, he admitted that he had used advanced hacking tools to break into Bitfinex's network, authorised the transfers himself, and then deleted access credentials and log files to cover his tracks.

How the money was traced

A bitcoin wallet is an address on a public ledger, the blockchain, that anyone can read, and the coins in it move only with a secret code called a private key. Stolen bitcoin cannot be erased, only moved, and every move is recorded. Lichtenstein's problem was turning coins that everyone was watching into money he could spend.

He tried most of the tricks. Prosecutors said he used fake identities to open accounts, moved small amounts through the darknet market AlphaBay and, after the FBI shut it down in 2017, through the Russian market Hydra. He used mixers, services that pool many people's coins and pay out different ones, the way cash goes into a laundromat's change machine. He converted coins into other cryptocurrencies, bought gold coins and gift cards, and spent some on NFTs, Uber rides and a PlayStation. Court papers said some of the gold coins were buried.

About 80 percent of the haul never left the original wallet. The break came when investigators, led by IRS Criminal Investigation, obtained a warrant for Lichtenstein's online cloud storage. Inside was an encrypted file. Once decrypted, it held a list of 2,000 wallet addresses with their private keys, and a spreadsheet tracking where the money had gone. The government used those keys to take the coins back.

Pleas, cooperation and sentences

On 3 August 2023 both pleaded guilty. Lichtenstein admitted money laundering conspiracy and confessed to the hack. Morgan admitted money laundering conspiracy and conspiracy to defraud the United States. Lichtenstein said Morgan had no part in the hack itself.

Lichtenstein then cooperated. In March 2024 he testified against Roman Sterlingov, the operator of the Bitcoin Fog mixer, saying he had used it to launder some of the money. Sterlingov was convicted and later sentenced to 12 and a half years.

In November 2024 US District Judge Colleen Kollar-Kotelly sentenced Lichtenstein to five years in prison, followed by three years of supervised release. Morgan received 18 months. Prosecutors had asked for those terms, below the sentencing guidelines, citing the couple's cooperation.

Out early, and the fight over the coins

Neither served the full term. Morgan began her sentence in January 2025 and was released in October 2025 after roughly eight months, according to CoinDesk and DL News. She has since returned to performing as Razzlekhan.

At the start of January 2026 Lichtenstein posted on X: "Thanks to President Trump's First Step Act, I have been released from prison early." The First Step Act, a 2018 prison reform law, lets inmates earn time off for training and rehabilitation programmes; he had served about 14 months and was moved to home confinement. He was not pardoned. He said he wanted to work in cybersecurity.

The money is still being argued over. The seized coins, worth about $3.6 billion in 2022, were worth more than $10 billion by early 2026. In January 2025 prosecutors asked the court to return about 94,643 bitcoin to Bitfinex in kind rather than sell them. Judge Kollar-Kotelly questioned whether that was proper, and claims to the coins were moved into a separate forfeiture proceeding, a court process for deciding who owns seized property, which was still running in 2026. Bitfinex has said it will use what it gets back to pay off its Recovery Right Tokens, and it promised in 2019 to use 80 percent of net recovered funds to buy back and destroy its LEO token.

The coins have started to move. In April 2026 a wallet tied to the US government sent a small amount of Bitfinex-linked bitcoin to Coinbase, CoinDesk reported. On 8 October 2026 blockchain data tracked by Arkham showed a government-labelled wallet moving 12,267 bitcoin, worth about $1 billion, out of an address holding coins from the hack. The government has not said where those coins are going.