DOJ arrests in Bitfinex case highlight inner workings of crypto laundering scheme

Law enforcement seized more than $3.6 billion in cryptocurrency linked to the hack, resulting in the Justice Department’s largest financial seizure ever, according to remarks from Deputy Attorney General Lisa Monaco.

“In a futile effort to maintain digital anonymity, the defendants laundered stolen funds through a labyrinth of cryptocurrency transactions,” Monaco said.

The details: Ilya Lichtenstein and his wife, Heather Morgan, “allegedly conspired to launder the proceeds of 119,754 bitcoin that were stolen from Bitfinex’s platform after a hacker breached Bitfinex’s systems and initiated more than 2,000 unauthorized transactions. Those unauthorized transactions sent the stolen bitcoin to a digital wallet under Lichtenstein’s control,” according to court documents.

Over five years, approximately 25,000 bitcoin were transferred out of Lichtenstein’s wallet, with some stolen funds being deposited into financial accounts controlled by Lichtenstein and Morgan, according to the Justice Department. “The remainder of the stolen funds, comprising more than 94,000 bitcoin, remained in the wallet used to receive and store the illegal proceeds from the hack,” the agency said.

Through search warrants, special agents accessed files within an online account controlled by Lichtenstein containing the private keys for the digital wallet, allowing the Justice Department to seize and recover the more than 94,000 bitcoin.

Sophisticated techniques: The criminal complaint alleges Lichtenstein and Morgan “employed numerous sophisticated laundering techniques,” including:

• Using fictitious identities to set up online accounts;
• Utilizing computer programs to automate transactions;
• Moving the funds in a series of smaller amounts across thousands of transactions;
• Depositing stolen funds into accounts at a variety of virtual currency exchanges and darknet markets and then withdrawing the funds;
• Converting bitcoin to other forms of virtual currency with enhanced anonymity; and
• Using U.S.-based business accounts to legitimize their banking activity.

The duo also “repeatedly provided false information to and deceived [virtual currency exchanges] and other financial institutions regarding the source of their funds and the nature of their transactions” to disrupt due diligence efforts and prevent the filing of suspicious activity reports (SARs) related to their activity, according to court documents.

Lichtenstein and Morgan are charged with conspiracy to commit money laundering, which carries a maximum sentence of 20 years in prison. They are also charged with conspiracy to defraud the United States, which carries a maximum sentence of five years in prison.

Bitfinex response: “We are pleased that the U.S. Department of Justice … announced that it has recovered a significant portion of the bitcoin stolen during the August 2016 security breach,” the company said in a statement. “We have been cooperating extensively with the DOJ since its investigation began and will continue to do so.

“Bitfinex will work with the DOJ and follow appropriate legal processes to establish our rights to a return of the stolen bitcoin. Bitfinex intends to provide further updates on its efforts to obtain a return of the stolen bitcoin as and when those updates are available.”