A public ledger let a 2016 theft be traced six years later

Inherited archive entry · retained from the earlier edition. Its factual, legal and policy claims have not all been reverified for 19 September 2026. Research scope.

What the 2022 arrest documents record

On 2 August 2016, a hacker breached Bitfinex's systems and initiated more than 2,000 unauthorised transactions, moving 119,754 bitcoin out of the exchange's wallets. Nothing about that transfer was hidden: it was recorded on Bitcoin's public ledger like any other transaction, an address anyone could watch. On 8 February 2022, the Department of Justice announced the arrest of Ilya Lichtenstein and Heather Morgan, and an ICE press release issued the same day states that law enforcement had by then seized over $3.6 billion in cryptocurrency linked to the theft, including more than 94,000 recovered bitcoin. A DOJ case page records that Lichtenstein and Morgan pleaded guilty on 3 August 2023 to money laundering conspiracy charges, and that Lichtenstein was sentenced in November 2024.

How a public ledger enabled the trace

The same transparency that let anyone see the stolen coins leave Bitfinex's wallets is what let investigators follow them for years afterward. The DOJ case page describes 'extensive layering of transactions, cryptocurrency mixers and non-compliant cryptocurrency exchanges, darknet markets, and bank accounts' used to obscure the trail, and the ICE release notes that only a portion of the stolen coins, about 25,000 bitcoin, moved out of the original wallet over five years despite that effort. Blockchain analysis does not require a warrant to read a public address; it requires patience and the tools to connect addresses to real identities, a harder problem than reading the chain itself, and one that took investigators roughly six years to solve for the bulk of the seized funds.

What custody meant for Bitfinex in 2016

Bitfinex operated as a custodian: customers held claims against the exchange, and the exchange held the underlying bitcoin in wallets it controlled. When those wallets were compromised, the loss fell first on the exchange's own holdings and, as widely reported at the time, on a haircut applied across customer balances. Tracing and seizing stolen coins years later does not undo that original custody failure; it is a separate, later recovery of specific assets tied to a specific criminal case, credited toward victims rather than instantly restored to a 2016 balance.

Questions to carry forward

• Does public traceability by itself prevent theft, or only make eventual attribution possible?
• What is the difference between an exchange spreading losses across customer balances and a later criminal forfeiture?
• How long can stolen funds sit dormant before movement creates a pattern investigators can follow?

The record here is two government documents, filed six years apart, describing the same theft from opposite ends: the moment coins left Bitfinex's control, and the moment law enforcement finally closed in on where much of it had gone.