46 ms·

Feds arrest couple, seize $3.6B in hacked Bitcoin funds

698 points by mikeyouse 5y ago

ratg13 5y ago
Does anyone know if Bitfinex will get this returned to them (and hopefully repay users) .. or what the next steps in this story might look like?
- spywaregorilla 5y ago
  What users?
  - ratg13 5y ago
    Bitfinex had to take a percentage of user's assets away due to the theft.
- evdubs 5y ago
  After this hack, Bitfinex account holders took a haircut (30% or so) and were given tokens representing the remainder of their dollar-denominated account balances. Those tokens were paid in full in 2017ish. Later, the UK, Portugal, and Poland seized $1B or so of Bitfinex customer funds due to the funds being delivered by Crypto Capital Corp who was found to be engaged in money laundering. Bitfinex issued LEO tokens to make up for that asset seizure, and have a clause that if the 2016 stolen bitcoins were recovered, they'd be used to retire the LEO tokens. That's why LEO has greatly increased in value recently. https://cryptowat.ch/charts/BITFINEX:LEO-USD?period=1d https://cryptowat.ch/charts/BITFINEX:LEO-USD?period=1d
  - johnmarcus 5y ago
    It's so odd that the story breaks today but LEO started jumping 8 days ago. No insider trading there, I am certain!
    - deadbunny 5y ago
      IIRC the coins moved about a week ago. Wouldn't surprise me if there was some speculation that they had been seized leading to some speculation.
JoeAltmaier 5y ago
With so much money involved, I wonder if we can ever really know anything. Enough money, and you can make black == white. E.g. these two were fallguys
- d23 5y ago
  Thankfully we have a legal process intended to figure this exact thing out via a process of presenting and considering evidence.
  - JoeAltmaier 5y ago
    And we don't think money comes into that?
mikeyouse 5y ago
> The Justice Department announced Tuesday it had seized more than $3.6 billion in bitcoin allegedly stolen as part of a 2016 hack of Bitfinex, saying authorities have also arrested and charged a husband and wife in New York for allegedly trying to launder the cryptocurrency fortune. > Officials said Ilya Lichtenstein, 34, and his wife, Heather Morgan, 31, were arrested on charges of conspiring to launder money. They are accused of trying to launder 119,754 bitcoin that were stolen after a hacker breached Bitfinex, a cryptocurrency exchange, and initiated more than 2,000 unauthorized transactions. Prosecutors said the bitcoin was sent to a digital wallet controlled by Lichtenstein. From the actual charging statement (https://www.justice.gov/opa/press-release/file/1470186/download?utm_medium=email&utm_source=govdelivery https://www.justice.gov/opa/press-release/file/1470186/downl...), the Feds have more details and fascinating traces through the various methods which the accused laundered the funds. Raises the question of whether they would've attracted so much attention if it were "only" a $70M hack instead of the multibillion dollar one due to BTC appreciation. > In or around August 2016, a hacker breached Victim VCE’s security systems and infiltrated its infrastructure. While inside Victim VCE’s network, the hacker was able to initiate over 2,000 unauthorized BTC transactions, in which approximately 119,754 BTC was transferred from Victim VCE’s wallets to an outside wallet. At the time of the breach, 119,754 BTC was valued at approximately $71 million. Due to the increase in the value6 of BTC since the breach, the stolen funds are valued at over $4.5 billion as of February 2022.
danso 5y ago
The statement of facts is linked to from the press release, and describes generally how the Feds were able to trace the stolen funds (they found a file listing private keys, after gaining access to the suspect's cloud storage) https://www.justice.gov/opa/press-release/file/1470186/download https://www.justice.gov/opa/press-release/file/1470186/downl... > The 2017 transfers notwithstanding, the majority of the stolen funds remained in Wallet 1CGA4s from August 2016 until January 31, 2022. On January 31, 2022, law enforcement gained access to Wallet 1CGA4s by decrypting a file saved to LICHTENSTEIN’s cloud storage account, which had been obtained pursuant to a search warrant. The file contained a list of 2,000 virtual currency addresses, along with corresponding private keys. > ...The connection among the VCE 1 accounts was further confirmed upon reviewing a spreadsheet saved to LICHTENSTEIN’s cloud storage account. The spreadsheet included the log-in information for accounts at various virtual currency exchanges and a notation regarding the status of the accounts > ...Lichtenstein Email 2 was held at a U.S.-based provider that offered email as well as cloud storage services, among other products. In 2021, agents obtained a copy of the contents of the cloud storage account pursuant to a search warrant. Upon reviewing the contents of the account, agents confirmed that the account was used by LICHTENSTEIN. However, a significant portion of the files were encrypted
- colinmhayes 5y ago
  $4 billion has got to buy an awful lot of compute time, but still, how did they decrypt the file?
  - danjac 5y ago
    Private key was uploaded to cloud storage that Feds had access to with a search warrant.
  - raverbashing 5y ago
    A fancy (or even basic) dictionary attack has a very high chance of working.
    - lupire 5y ago
fxtentacle 5y ago
Shouldn't all true crypto believers hate this news? It's the government trying to enforce their opinion of who should own those Bitcoins, thereby taking power away from the owner that the network has decided on, which would be "whoever has the cryptographic keys".
- nathias 5y ago
  how has anything changed in this sense? The owners of bitcoins are always whoever has the crypto keys, that isn't an imperative it's just a fact, now the fed has the keys.
- gruez 5y ago
  Seems like a win to me. The government had to physically go to their house and arrest them to get to their funds, whereas normally all they had to do was call up their bank and had their money frozen. Not to mention, this threat could have been easily mitigated by keeping your funds in a multsig wallet, with the keys distributed in multiple redundant locations.
  - sschueller 5y ago
    Also crypto people have a problem with central banks manipulating currency by printing more etc. Having stolen coins recovered seems like an OK thing.
    - harambae 5y ago
      The classic libertarian adage is that a government powerful enough to give you everything you want is powerful enough to take everything you have. Some corollary would apply here. (it's not that anyone particularly loves letting criminals off the hook, it's granting that ability is a slippery slope)
  - panarky 5y ago
    It's similar to privacy and surveillance. To secretly monitor a single individual's communications, law enforcement should have to get probable cause, present their case to a judge and obtain a court order. Dragnet surveillance of all communications all the time is a Very Bad Thing. Financial surveillance and seizure is currently at the Very Bad Thing stage and bitcoin helps move us back toward a better balance between the rights of the individual and the interests of the state.
albroland 5y ago
fwiw, it appears one of the named here is a YC Alum: https://news.ycombinator.com/user?id=il https://news.ycombinator.com/user?id=il https://www.linkedin.com/in/unrealdutch/ https://www.linkedin.com/in/unrealdutch/
- rednerrus 5y ago
  Andreessen roasting this guy all morning is making my day: https://twitter.com/pmarca/status/1491150099518398466 https://twitter.com/pmarca/status/1491150099518398466
  - toomuchtodo 5y ago
    Replies to his tweet are just top notch. “your memes do have out-of-touch-dad-trying-to-be-cool energy tho”
  - EVa5I7bHFq9mnYK 5y ago
    Wow, twitter went full pinterest now and refuses to let me read tweets without an account ...
- zozbot234 5y ago
  That's a nice username I guess.
- deleted 5y ago
  [deleted]
- sydthrowaway 5y ago
  Thin red line between scamming and hustling.
  - optimalsolver 5y ago
    Well, yes. If you can socially engineer customer support staff, you can do the same to venture capitalists.
rasz 5y ago
"Today Ilya Lichtenstein is the co-founder of the Y Combinator backed Mix Rank," One of the first Google results for the names returns 'Get your first $1 million in enterprise sales with zero marketing spend' https://www.youtube.com/watch?v=DuIr5IFQ9Xg https://www.youtube.com/watch?v=DuIr5IFQ9Xg Heather R Morgan Serial entrepreneur SaaS Investor Razzlekhan = Surrealist Artist, Rapper & Fashion Designer with synesthesia Also Forbes writer https://www.inc.com/heather-r-morgan/dont-hire-a-salesperson-who-doesnt-have-these-traits.html https://www.inc.com/heather-r-morgan/dont-hire-a-salesperson... "As I build a sales team for my latest software startup, Endpass" Endpass "Bringing you the delightful and secure Ethereum wallet that's easy enough for grandma to use." Wait, so did Feds nab them for running Ethereum wallet startup and claim $3B in client wallets as theirs? Or did the pair start Ethereum wallet company to wash stolen coints?
- duxup 5y ago
  Did Mix Rank take bitcon?
- ordinaryradical 5y ago
  Were they married at the time of this interview?
- gk1 5y ago
  I met Heather many years ago. It's a weird feeling to see a name you recognize in an announcement like this. We've lost touch long since so I have no comment.
  - capableweb 5y ago
    > We've lost touch long since so I have no comment But felt it was important enough to state that you know her? I'm not sure what your comment is supposed to be.
    - zkldi 5y ago
      jeez man, not every comment has to be a profound statement. I thought it was pretty interesting.
kisamoto 5y ago
In a hypothetical, if the two did not breach Bitfinex servers (unauthorized access to others systems) but instead managed to "guess" the private key to the Bitfinex wallet and transfer the funds, would this also be a crime? Would this be treated the same way?
- runeks 5y ago
  Wouldn't it still be laundering?
- realce 5y ago
  Computer Fraud and Abuse Act covers any unauthorized access regardless of how the credentials were obtained or... magically guessed.
  - lupire 5y ago
    Also, grand larceny applies if you guess the code to unlock a car.
    - bpodgursky 5y ago
      It applies even if the car isn't locked... it applies any time you take something you know isn't yours.
  - nybble41 5y ago
    In the scenario outlined there would be no unauthorized access to any systems, whether owned by Bitfinex or anyone else, so I really don't see how the CFAA could possibly apply here. As for the cryptocurrency network itself, the protocol is that anyone who has the private key is authorized to spend the corresponding funds—how the key was obtained is irrelevant. Of course, correctly guessing a 256-bit random private key is exceedingly unlikely, though if they key is based on a lower-entropy password (a "brain wallet") then the odds of a correct guess improve dramatically.
    - deleted 5y ago
      [deleted]
duxup 5y ago
>According to court documents, Lichtenstein and Morgan allegedly conspired to launder the proceeds of 119,754 bitcoin that were stolen from Bitfinex’s platform after a hacker breached Bitfinex’s systems and initiated more than 2,000 unauthorized transactions. Those unauthorized transactions sent the stolen bitcoin to a digital wallet under Lichtenstein’s control. Over the last five years, approximately 25,000 of those stolen bitcoin were transferred out of Lichtenstein’s wallet via a complicated money laundering process that ended with some of the stolen funds being deposited into financial accounts controlled by Lichtenstein and Morgan. Sounds like they were very much involved in the hack... or someone hacked Bitfinex and gifted them the coins?
- mikeyouse 5y ago
  Yeah -- It reads like they didn't have the evidence to prove they hacked Bitfinex, but plenty of evidence they're the only ones that moved the hacked funds. Hence the lack of CFAA or other charges in favor of money laundering ConFraudUS.
loceng 5y ago
I ask this every so often during threads regarding stolen cryptocurrency: Is there any solution yet to preventing stolen cryptocurrency funds from being spent? Isn't the only solution to have a central database and require laws to require every transaction to be pre-checked to see if it's stolen funds or not? And not only that, the centralized system will have to be constantly keeping track of wallet mixing to see where funds are being redirected to, attempted to being washed to?
- pcthrowaway 5y ago
  With some things, such as the stablecoin USDC, the issuer can prevent specific addresses from transferring them
  - runeks 5y ago
    Which is only possible because it's centralized
    - knownjorbist 5y ago
      A DAO could just as easily decide to do the same, but it'd need to be built into the smart contracts.
      - pcthrowaway 5y ago
        This works with the smart contracts with USDC, it's just that there's an authority which has permission to update the state to deny transfers from a specific address. This is because USDC is a centralized stablecoin (as is USDT). There are decentralized stablecoins such as UST and MIM (and I believe DAI as well).
        knownjorbist 5y ago
        Correct, though on second thought, given how slow many DAOs are to operate, the perpetrators would already be in some other uncontrollable currency by the time people voted to blacklist certain wallets.
throwaway110535 5y ago
25 years max for stealing billions? God bless America. > Lichtenstein and Morgan are charged with conspiracy to commit money laundering, which carries a maximum sentence of 20 years in prison, and conspiracy to defraud the United States, which carries a maximum sentence of five years in prison. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.
- twox2 5y ago
  Are you suggesting that's a light punishment?
  - throwaway110535 5y ago
    Given that folks have been given longer punishments for stealing less, yes. Granted, ianal and I acknowledge that things come into play like repeat offenses, etc.
    - twox2 5y ago
      At the same time, though, folks get lighter sentences for rape and murder. IMO there's nothing 30,40,50+ years can do to a person that 25 can't.
      - throwaway110535 5y ago
        touché
- gruez 5y ago
  >25 years max for stealing billions? 1. The bitcoins were only worth ~$70 million at the time of theft. saying they stole "billions" is highly misleading 2. I don't get it, aren't we supposed to be getting less "tough on crime", especially for non-violent offenses?
  - throwaway110535 5y ago
throwaway9191aa 5y ago
I'm not well versed in BTC, so my prices may be wrong. But this is webscale in a way I haven't thought of before. It is alleged they stole 119754 BTC, which in 2016 was < $1000USD. Which would have been < $100,000,000. Today, it is worth 5bln. (not that 100mm is nothing.... but it is a lot less). Could you imagine stealing something that most people thought was a toy. Suddenly it became so valuable that the government could justify who-knows-how-much resources to catch you?
ilamont 5y ago
Are there any cases involving theft of this scale (or even 1/10th of this scale) that have been successfully prosecuted in the U.S.?
- elkos 5y ago
  The scale was around $70mil at 2016.
openhandcrimp 5y ago
It seems that Tornado Cash (https://tornado.cash/ https://tornado.cash/) could have been used to launder the funds. I wonder if: - Laundering happened before Tornado Cash existed, so Tornado Cash was not used - They used something like Tornado Cash, but the funds were still traceable
- gruez 5y ago
  As other commenters have noted, they stored the public/private keys on a cloud drive. A coin mixer isn't going to save you from that.
- runeks 5y ago
  Are you using Tornado Cash to launder money?
  - gruez 5y ago
    Yeah wtf, I'm not sure why he's randomly namedropping it.
    - openhandcrimp 5y ago
      I don't understand why you are being so aggressive. This is a post about news on laundering crypto. I am aware of a technology that seems to cater to that use case.
      - jhugo 5y ago
        I would assume that it's because your comment reads like an advertisement, since it name-drops (and links to) a specific mixer rather than just saying "It seems that a coin mixer could have been used..." Is there anything novel about this particular mixer? If not, why link to this one specifically?
  - openhandcrimp 5y ago
    I am personally not, but don't you think that use case is obvious?
mgh2 5y ago
Dupe: https://news.ycombinator.com/item?id=30260987 https://news.ycombinator.com/item?id=30260987
mdoms 5y ago
> “Today, federal law enforcement demonstrates once again that we can follow money through the blockchain, and that we will not allow cryptocurrency to be a safe haven for money laundering or a zone of lawlessness within our financial system,” said Assistant Attorney General Kenneth A. Polite Jr. of the Justice Department’s Criminal Division. How is this not a total death blow for bitcoin? If the justice department can do it, anyone can. It's a public ledger. So you effectively must treat every transaction you ever make on the blockchain as totally public and tied directly to you.
- vmception 5y ago
  Because there is a weak link in the methods these guys used. The DOJ always pats itself on the back to pretend to the worldwide audience that there is "no" illicit money in the US financial system. They don't say "good thing they didn't use X method! that would have hampered our investigation irreparably!" at least not in press releases.
- AlexanderTheGr8 5y ago
  It took them 6 years to catch these perps. And these perps were extremely sloppy (storing keys in cloud, weak encryption) Justice must give the perception that they are doing enough. They can't really say that it's really hard to catch people committing crimes in cryptocurrencies.
AlexanderTheGr8 5y ago
> “After the execution of court-authorized search warrants of online accounts controlled by Lichtenstein and Morgan, special agents obtained access to files within an online account controlled by Lichtenstein,” the press release said. “Those files contained the private keys required to access the digital wallet that directly received the funds stolen from Bitfinex, and allowed special agents to lawfully seize and recover more than 94,000 bitcoin that had been stolen from Bitfinex. The recovered bitcoin was valued at over $3.6 billion at the time of seizure.” So most likely, 1) they didn't launder it properly, leading to police being able to trace it to their bank accounts. I wonder if tornado.cash was used. 2) then police had their names, leading to warrants for all online accounts - google account, apple account, etc. 3) they made the big blunder of keeping their private keys in their online account. Most likely a txt file in google drive. That is such a silly blunder. Without the private keys, the police has zero proof of anything. They could have made a hundred excuses for how they got money in their bank account, as long as the police didn't have the private keys. Who keeps their private keys in an online account? Apparently the biggest criminals make too many silly mistakes. The old saying applies here: "you don't have to be smart, just don't be an idiot"
- duxup 5y ago
  Well you don't want to lose those keys ... there is a bit of a conundrum there (granted you don't have to do it the way they did either). As far as how exactly they got caught, there was a reward offered by the company it was stolen from. It may have been someone tipped the feds off for the reward.
  - AlexanderTheGr8 5y ago
    Crypto 101: never store private keys online.
    - giaour 5y ago
      Crypto 102: weep for the coins you lost when your cousin spilled soda on the hard drive containing the offline-only copy of your private keys
caseysoftware 5y ago
I'm sitting here trying to understand their mindset. They had to know what kind of scrutiny would be on those coins forever. At the time of the theft, the coins are worth $100M+ and they can't touch them. Even worse, anything they do with them will be monitored, researched, dug into, and everything else from law enforcement, amateur detectives, and every major tech+crime group. Fast forward to now and the coins are worth 50x that.. and now they try to move them? And all the keys are in cloud storage? But it had to be frustrating to be sitting on something so valuable without any way to use it. They had to be stressed and anxious about it. A life of crime is stupid. A life of crime for something this high profile is far beyond stupid.
- duxup 5y ago
  I was wondering about this. I would think the most obvious path would be to find some other criminals (now you've got new risks) who don't care about the provenance of the coins, will pay cash for some coins at a discount, and you somehow launder that cash.... Could at least get a couple bucks from it, possibly.
  - tannhauser23 5y ago
    There are "local bitcoin trading" groups that do exactly this - convert bitcoin to cash at a discount. But obviously you can't do this for billions of dollars and you expose yourself to personal monitoring and capture.
    - giaour 5y ago
      I'd bet there's a non-zero chance your exchange counterparty at one of these groups is an undercover cop.
  - hedora 5y ago
    On the one hand, the mob would probably be happy to buy them for 10-30% face value. On the other hand, how do you contact a reputable mob boss?
shiado 5y ago
It never ceases to amaze me how incompetent some high profile criminals are. Encrypting a file is simply too difficult apparently. The entire purpose of crypto is that the exclusive holder of a private key cannot have funds seized. A 15 year old kid probably has better opsec with their crypto wallets than these people. Astonishing really.
- vmception 5y ago
  yeah I've never seen a crypto investigation that made me impressed with the government's abilities, nothing that surprised me about the utility of OPSEC best practices, only people with weak links and dumb behaviors that are incompatible with doing something criminal.
  - from 5y ago
    You're not serious, right? You clearly haven't seen some of the latest unlicensed money transmitter prosecutions. The resourceful agents over at HSI have come up with an incredibly effective method of stopping crime in the Bitcoin network. It looks something like: CS1: "I would like to exchange these dollars which I represent to be the proceeds of the sale of controlled substances in violation of the Controlled Substances Act for Bitcoin." Localbitcoins trader: "OK."
    - vmception 5y ago
      4D Quantum Chess right there
lbriner 5y ago
Serious question though, we live in a time when a mere mortal is able to carry out an enormous financial crime, whose knock-on effects could be enormous to millions of people directly and indirectly. How do you put a relevant sentence on that? Even whole-life in prison doesn't really make up for the number of people who might be affected by it. note, I didn't read the article, it was just the headline that made me ask the question so possibly slightly off-topic.
vmception 5y ago
> “digital currency heists executed through complex money laundering schemes could undermine confidence in cryptocurrency,” said U.S. Attorney Matthew M. Graves Well now you US prosecutors aren't reading hacker news!
- vmception 5y ago
  now you ^know
deleted 5y ago
[deleted]
nodesocket 5y ago
Does this mean users who lost everything on bitfinex will be contacted and could possibly recover their coins? Can you imagine waking up to realize you are rich because the feds seized the coins and are returning to you.
- deleted 5y ago
  [deleted]
- paulpauper 5y ago
  It means the BTC will re-enter market eventually , so not good for longs.
- chaoz_ 5y ago
  Fascinating way to HODL to the token indeed.
joshbaptiste 5y ago
Why would a Russian national with so much BTC to launder, who hasn't touched it in 6 years suddenly perform the action from New York City of all places from within the USA.
- miohtama 5y ago
  It is explained in the court documents. Please read the PDF.
  - rosndo 5y ago
    It really isn’t.
- polynomial 5y ago
  Ilya is a Russian national? (Sorry, I hadn't sees that mentioned yet.)
  - mikeyouse 5y ago
    Yep - dual citizen. Though via his LinkedIn, he went to at least High School and College in the US.
- pavel_lishin 5y ago
  I don't know why people assume that Russia is a lawless land where you can just cash out billions of dollars worth of stolen cryptocurrency. Even if that were the case, maybe they rationally decided that the risk of pissing off United States federal authorities was better than pissing off Russian authorities and organized crime.
paulpauper 5y ago
Not a a lone Russian hacker, but American citizens..a husband and wife couple. crazy.
- dcist 5y ago
  the husband is Russian-American
deepsun 5y ago
Should I expect price drop once feds start to sell it? Or they'll just destroy the keys (keeping the money invested forever).
- lern_too_spel 5y ago
  It will probably be returned to Bitfinex if they can access the wallet.
  - bastawhiz 5y ago
    That's assuming the feds don't have unfinished business with Bitfinex. They're not exactly on great terms.
    - lern_too_spel 5y ago
      That's just nitpicking. If Bitfinex is acting as a custodian, the property will be returned to the owners. Whether that return happens via Bitfinex or via the feds looking at Bitfinex's books doesn't really change much. The point is that the feds can't destroy property just because they don't like who it was stolen from.
      - bastawhiz 5y ago
        The feds have no problem seizing and liquidating property. They do it all the time. They even recruit local law enforcement to do it for them. See "equitable sharing"
        lern_too_spel 5y ago
        That's if the property was purchased using money obtained from selling illegal goods or services. If the property doesn't belong to the criminal, it's an entirely different situation.
- Lev1a 5y ago
  I'd actually really like if they used this opportunity to drive the Bitcoin price straight into the ground, thereby ruining that market for all those speculative investors. Maybe that'd allow for something of a reboot of the ecosystem having eliminated the scum that usually starts to invade any remotely financially exploitable system after a while.
mittermayr 5y ago
Sometimes I wonder what the chances are that certain (highly privileged) staff at Google (or other similar data storage or e-mail companies) could run a query across Google Drive looking for a specific public key. Much like a malware scanner, just looking for "a key", just to see if there is an account matching. Unofficially, of course. A rogue employee perhaps. And, what if, in such a case, the employee (in the best of cases) reports the person anonymously, or in other cases, takes off with the private key if also found. Or does anyone know if the data is so encrypted that nobody at Google can override? I would highly doubt that, looking at US law enforcement pressure. And I am sure there's a million and one barriers and access requests blocking raw queries, but technically... Of course, a hefty hefty conspiracy-laden thought, but I just found myself curious if that would even remotely be an option.
- bagacrap 5y ago
  I think the perp encrypted the file themselves before uploading to Google cloud (or wherever). The encryption was not provided by the platform.
- paulpauper 5y ago
  this would be trivial to code and could search for one of the bip 39 dictionary words. github key thieves do this already.
  - vmception 5y ago
    Happened to many on dropbox too You would never know if it was somebody employed there or at the data center or at the government agency tapping the servers
    - dannyw 5y ago
      Yep, I definitely recall numerous incidents of people putting a private key onto a dropbox file, never sharing it with anyone, have 2FA on their accounts (with no unauthorized activity), and then seeing funds disappear.
- 5y ago
jrav 5y ago
Probably stupid question: Why not just exchange it to zcash or monero or some other coin that hides transaction details? Then you can send it to a new wallet; theoretically 100% untraceably. Is this not a valid approach?
- miohtama 5y ago
  If you read the court PDFs you see that they tried it.
- AlexanderTheGr8 5y ago
  One possibility is that almost all exchanges require KYC today.
- uncomputation 5y ago
  The transaction from BTC to Monero is traceable.
  - cirowrc 5y ago
    with atomic swaps that make use of taproot, that wouldn't be distinguishable from, say, opening a lightning channel, but still, there's not enough liquidity there (and this is very recent stuff anyway)
- Gasp0de 5y ago
  They did that apparently, it is mentioned in the article. There are still ways to trace it. For example, if they do it in a short timeframe or in just two transactions you can match the amounts. Not many people send 100k$ in zCash around.
  - 0des 5y ago
    Amounts are not public with Monero outputs created within the last few years.
    - benreesman 5y ago
vmception 5y ago
> charged with conspiracy to commit money laundering, and conspiracy to defraud the United States Do you think there are more charges to come? If they think they actually laundered money through businesses, why didn't they charge them with multiple counts of money laundering and multiple counts of wire fraud and a violation of the CFAA?
- vmception 5y ago
  I’m actually wondering if there are serious doubts here. Especially due to the weaker charges levied, and watching the cringy @realrazzlekhan tiktok page where everyone also has their doubts about these people’s competence. Darknet markets sell IDs, the DOJ also says the hackers used fake IDs to reintegrate the money. This fairly welloff couple (lives in Manhattan condo, owns bengal cat and jewelry) could easily just be one of the IDs. Both the husband and wife are early crypto proponents but that might just be circumstantial to both the DOJ and the hacker who got their IDs. Watching this one. Its like they got just enough of data for a charge to get the subpoenas and warrants, but not enough to go for the bigger more damning charges.
  - seibelj 5y ago
    If you read the complaint it is pretty clear they were at least heavily involved. Their personal accounts and businesses were tied up into it.
    - vmception 5y ago
      I’m still reading it They definitely had custody of the funds and felt obligated to try and launder it It seems like the government needs to figure out if they were the only ones with custody, which is proving a negative with private keys, but the government seems to feel like it’s needs a greater proof of the actual heist of bitfinex so they can pin the rest on this couple. Still reading though, this is just what I’ve parsed so far. The IRS-CI agent had requested CFAA and Wire Fraud charges.
      - 5y ago
nathias 5y ago
should have used monero
emerged 5y ago
This is the type of hack you need to be both smart enough and dumb enough to commit.
pdog 5y ago
Ilya Lichtenstein (YC S11) is the co-founder of YC-backed MixRank. Heather Morgan, his wife, is apparently a serial entrepreneur, investor, and "contributor" to Forbes.
- cam0 5y ago
  Her Forbes bio: Heather R. Morgan is an international economist, serial entrepreneur, and investor in B2B software companies. She is an expert in persuasion, social engineering, and game theory.
  - rasz 5y ago
    she also ran Endpass "Bringing you the delightful and secure Ethereum wallet that's easy enough for grandma to use."
  - robbedpeter 5y ago
    "The infamous Crocodile of Wall Street" lol. They certainly thought an awful lot of themselves - it's fascinating to dig into their public facing digital trail. If they played by the rules they'd have been living large as part of the .001% of the world. They bought themselves a giant lead brick and chained themselves to it. It'd be sad if it weren't so stereotypically comical.
- localhost 5y ago
  She's also a rapper, and not a very good one: https://www.youtube.com/watch?v=_DIuPPmY9mw https://www.youtube.com/watch?v=_DIuPPmY9mw
  - outside1234 5y ago
    "0FCKs given" This whole crypto space is just a giant show of "Punk't" isn't it. This can't be real - it is just parodies the whole way down.
  - 323 5y ago
    Doesn't matter, she's going viral now
FDSGSG 5y ago
So uh, does this money get returned to Bitfinex now? Is this a huge windfall for them? They've fully redeemed their BFX tokens for whatever that's worth.
Severian 5y ago
So, hypothetically, if these guys were to completely cash out these coins somehow, and then pay tax to the IRS, would they be immune from tax fraud and IRS involvement? I know similar things happen with stolen property and illegal drugs (Sullivan v. United States).
- vmception 5y ago
  Yes if they successfully laundered it and paid taxes they would have no liability.
  - Severian 5y ago
    Probably liability to the Fed, but not local prosecutors for whatever locality Bitfinex was in then? Are bitcoins recognized as personal property, IP, none, or something of a blend in smaller jurisdictions? I have no idea.
    - vmception 5y ago
      they wouldn’t know who to hold accountable either. The point is that nobody would. In my model the only liability would occur from the normal day to day business operation that you earn the successfully laundered proceeds from. like one of your actual clients sue you because you breached the SLA because you forgot you’re actually running a legitimate business.
300bps 5y ago
The hack occurred 5.5 years ago. The Federal statute of limitations on Grand Theft/Larceny is 5 years. Is this why they are charged with Conspiracy to Commit Money Laundring and not charged with the actual theft? Lichtenstein and Morgan are charged with conspiracy to commit money laundering If so, this means that (outside tax obligations) they may have gotten away with it essentially by sitting on the money doing nothing for 5 years and then openly transferred it to themselves. Since they took actions that were meant to launder the money, they opened themselves up to the money laundering charges on their own. https://www.law.cornell.edu/uscode/text/18/3282 https://www.law.cornell.edu/uscode/text/18/3282 This is similar to many financial regulations where you can have completely legally obtained money but if you deposit $9,000 followed by depositing $1,000 thereby avoiding a CTR notification to the government required for a $10,000 deposit, you're guilty of "structuring" your deposits. https://www.fincen.gov/sites/default/files/shared/CTRPamphlet.pdf https://www.fincen.gov/sites/default/files/shared/CTRPamphle...
- deleted 5y ago
  [deleted]
- peter303 5y ago
  Structured transactions dont have an amount threshold. Former Speaker of the House Hastert got jail for sub-threshold transactions.
- mikeyouse 5y ago
  It's definitely not that easy... They would be sued in Civil Court for the entire amount, the Feds have a variety of options for 10-year statutes that could be implicated when they transfer the funds to a bank (wire fraud, mail fraud, bank fraud) and they would have to pay taxes on the funds lest they are implicated in tax fraud. It's hard work being a criminal.
counternotions 5y ago
Wow can't wait for this book.
- peter303 5y ago
  Or the movie. Who should play Lichtenstein?
onemoresoop 5y ago
Will this make bitcoin plummet? I figure that all these stolen stashes of BTC lowered the supply on the market and with these new available coins it will plummet somewhat.
ericmay 5y ago
Beautiful. Kudos to the FBI and the US Government for nailing these criminals.
jupblb 5y ago
And to think ~10 years ago it was subject of a joke to call police because of theft of fictional online goods [1]. [1]: https://www.youtube.com/watch?v=jSyjcib_Fps https://www.youtube.com/watch?v=jSyjcib_Fps
JumpCrisscross 5y ago
What possesses someone who just stole billions to stay in New York while trying to launder their money? Staying and pretending it didn't happen, I get. Pulling a Marsalek, I get. But staying? While continuing to try and access that wealth? Is it arrogance? Stupidity? Misplaced faith in the anonymity of crypto?
- abvdasker 5y ago
  Reminds me of Ross Ulbricht getting busted for running Silk Road. If you're running the largest black market for drugs in human history, why in the world would you stay in San Francisco???
deleted 5y ago
[deleted]
neonate 5y ago
http://web.archive.org/web/20220208165810/https://www.washingtonpost.com/national-security/2022/02/08/bitfinex-hack-bitcoin-arrests/ http://web.archive.org/web/20220208165810/https://www.washin... https://archive.is/IcdPK https://archive.is/IcdPK
AlexanderTheGr8 5y ago
> One overlooked detail in the Razzlekahn arrest. Almost all the money went through AlphaBay, using it as a mixer. The feds were able to see through this because they seized AlphaBay. Its amazing how, even years after, darknet market seizures pay dividends to the feds. Another fascinating detail. Source: https://twitter.com/ncweaver/status/1491118233973571585 https://twitter.com/ncweaver/status/1491118233973571585
- vmception 5y ago
  Why do they call it Razzlekahn? I was just watching her tiktok account, pure cringe.
  - sharken 5y ago
    Razzle looks like a female version of the male rapper Rahzel, who is also from New York. https://en.m.wikipedia.org/wiki/Rahzel https://en.m.wikipedia.org/wiki/Rahzel And Khan is from Genghis Khan, as mentioned here: https://www.lyrics.com/sub-artist/Razzlekhan/28366 https://www.lyrics.com/sub-artist/Razzlekhan/28366 But this is all just a guess.
- young_unixer 5y ago
  Another reason why Monero is better. With Monero, it wouldn't have mattered that AlphaBay was hacked.
  - 323 5y ago
    Funny you would say that, because if you read the indictment, these people did actually deposit Monero on one exchange: > VCE 4 Account 2 was entirely funded by approximately 13,200 XMR via approximately 21 transactions that took place between in or around November 2017 and March 2019. > Another account at VCE 4 (“VCE 4 Account 3”) was created on or about November 20, 2017, and was registered in the name of another Russian national and under another Russian email address. VCE 4 Account 3 was entirely funded by approximately 6,870 XMR, via approximately 10 transactions that took place between in or around November 2017 and April 2019. > The XMR deposited into VCE 4 Account 2 and VCE 4 Account 3 was all converted to BTC and then withdrawn, consistent with chain hopping. The same method was used to liquidate the funds from the VCE 1 accounts as described above.
dannylandau 5y ago
So, who did the hack? And why did original hacker transfer funds to Lichtenstein?
- deleted 5y ago
  [deleted]
jnwatson 5y ago
This is a great argument for Monero. It is much easier to launder money on a privacy-oriented blockchain.
maboo 5y ago
Ilya is a good guy, I don't think he's guilty. there's gotta be a misunderstanding everyone thinks this story is about me
- elkos 5y ago
  How are you involved in this story?
  - coolspot 5y ago
    > editor on rapgenius.com There is a rapper involved in the case.
mrkramer 5y ago
>Hackers Move $3.55B Worth of Bitcoin from 2016 Bitfinex Hack https://news.ycombinator.com/item?id=30162085 https://news.ycombinator.com/item?id=30162085 So government was moving bitcoins not hackers. Like I said in that thread it is easier to launder cash than bitcoins because bitcoins are on chain forever and cold cash can be laundered in numerous ways.
- tradertef 5y ago
  Thanks for sharing this. Hilarious comments :)
gzer0 5y ago
Here's how the fed caught them: "The DOJ said it was able to seize the funds after an FBI search warrant of one of Lichtenstein's cloud storage accounts found a file containing cryptocurrency addresses and their corresponding private key that granted access to funds stored within."
- newbie789 5y ago
- kart23 5y ago
  what the... no way they just kept an unencrypted private key on the cloud.
  - johnmarcus 5y ago
    the file was encrypted, but the fbi hacked it after already having gained access to the account (via warrent). Which is to say, this isn't how they actually got cought, it's just how the nail will go in the coffin (and thankfully for those impacted, some funds recovered). FWIW, if you ever find yourself in this position of owning a large amount of stolen crypto, I believe the best way to wash it would be to "robin hood it out" to a bunch of random wallets. You just happen to own 10-20% of the wallets, but the feds now have to try and track thousands of different people over years to try and identify the true thief, and there will always be plausible deniability.
    - ed 5y ago
      Interesting idea. But you’d only need to sample a small number of wallets to see the same person appear twice.
    - alfalfasprout 5y ago
      or buy extremely expensive tangible assets (diamonds, gold, bulk quantities of drugs). But billions of dollars worth? Forget it.
  - manquer 5y ago
ncmncm 5y ago
- nojito 5y ago
  Sure if ignore the findings from Mueller.
- teraflop 5y ago
  Would you say the Senate Intelligence Committee report, which was released by a committee of 8 Republicans and 7 Democrats, and which found that: > Russian intelligence services' assault on the integrity of the 2016 U.S. electoral process[,] and Trump and his associates' participation in and enabling of this Russian activity, represents one of the single most grave counterintelligence threats to American national security in the modern era. was also entirely fabricated by the Clinton campaign?
- pyronite 5y ago
  > He snagged a Pulitzer for a story about something that never had any primary source, that was entirely fabricated by political operatives then working for Hillary Clinton's campaign. There was a multi-year government report indicating that "the Russian government 'interfered in the 2016 presidential election in sweeping and systematic fashion' and 'violated U.S. criminal law'." Source and further reading if desired: https://en.wikipedia.org/wiki/Mueller_report#Russian_interference https://en.wikipedia.org/wiki/Mueller_report#Russian_interfe... The Justice Department under former Attorney General Bill Barr tried to determine who had leaked to the reporter, Devlin Barrett, because the information he published was accurate and classified: https://www.washingtonpost.com/national-security/washington-post-trump-reporter-emails/2021/07/13/27c1f04e-e41f-11eb-b722-89ea0dde7771_story.html https://www.washingtonpost.com/national-security/washington-...
- tomweingarten 5y ago
  Do you have examples of false articles he published? I can't find any examples of work he's done that comes close to comparing to Roger Stone's crimes.
- deleted 5y ago
  [deleted]
counternotions 5y ago
The wife could plead not guilty by reason of insanity: https://twitter.com/matthewesp/status/1491116443207094272?s=21 https://twitter.com/matthewesp/status/1491116443207094272?s=...
- johnmarcus 5y ago
  have you seen her rap video? https://razzlekhan.com/ https://razzlekhan.com/ She should be arrested purely for subjecting people to its existence.
majani 5y ago
What's shocking to me is that the hack was actually real and not just an inside job by Bitfinex employees
- mrkramer 5y ago
  For example Mt. Gox hack was also most probably hack not an inside job because that guy Mark Karpelès was so incompetent running the exchange no wonder it got hacked every now and then.
modeless 5y ago
So what will happen to the coins? They'll probably be looking for any excuse to avoid giving billions back to Bitfinex. This will be fascinating.
- peter303 5y ago
  DOJ says they'll be returned to previous owners.
  - modeless 5y ago
    Sure, but what does that mean? Will they return it to Bitfinex to distribute? Will they try to distribute it themselves? How will the accounting for who owns it work given Bitfinex's complex (and probably illegal under US law) token scheme that they implemented to cover up the hack? Will they return amounts calculated based on the value stolen in 2016, or the value of the coins now, a 60x difference? Will they sell the coins and transfer dollars to claimants, or transfer the coins directly?
tdhz77 5y ago
ilya@mixrank.com
subpixel 5y ago
"When she's not reverse-engineering black markets to think of better ways to combat fraud and cybercrime, she enjoys rapping and designing streetwear fashion." My online bio need some levelling-up. https://www.forbes.com/sites/heathermorgan/?sh=6e246df87f7d https://www.forbes.com/sites/heathermorgan/?sh=6e246df87f7d
- latchkey 5y ago
  https://www.youtube.com/watch?v=f5s4taHrEWA https://www.youtube.com/watch?v=f5s4taHrEWA
- deleted 5y ago
  [deleted]
joecool1029 5y ago
I was thinking, we know the feds have seized bitcoin and auctioned (laundered) them off later on. Cash often gets seized too. What happens if a criminal tries to burn cash and is mostly successful in doing so? Do the feds go to the BEP with a claim to get the money reprinted; or, like burned bitcoin, is it gone forever?
vmception 5y ago
> While it is possible that SalesFolk received virtual currency, based on my experience, companies that do offer virtual currency as a payment method or in conjunction with another service often advertise it to attract more business. Disagree here. I know many institutional funds that accept crypto for investment, solely because the third party fund administrator allows it, who only updated to account for that because so many funds and limited partners wanted that. You would have no idea how much is happening behind the scenes, with the merchant services pushes being just a small tip of an iceberg with its own success or failures.
- soared 5y ago
  I was going to disagree, but it turns out you’re right. Home Depot and a few other companies do accept crypto and they are not trying to meme about it.
m3kw9 5y ago
What happens to the seized bitcoins?
dorlevi 5y ago
"How to Social Engineer Your Way Into Anything — Heather R. Morgan | NYC Salon 101 " : https://youtu.be/JmahJCWJ8iM?t=1572 https://youtu.be/JmahJCWJ8iM?t=1572 Heather Morgan explaining how you can social engineer yourself out of a bad situation, can't make this shit up.
mmh0000 5y ago
More people needs to learn about CoinJoins[0]. "CoinJoin is a trustless method for combining multiple Bitcoin payments from multiple spenders into a single transaction to make it more difficult for outside parties to determine which spender paid which recipient or recipients. Unlike many other privacy solutions, coinjoin transactions do not require a modification to the bitcoin protocol." [0] https://en.bitcoin.it/wiki/CoinJoin https://en.bitcoin.it/wiki/CoinJoin
- jacquesm 5y ago
  Great idea, now you are not only liable for your own activities, but also for lots of other activities possibly much worse than your own. This seems to be a pretty nerdy idea of 'how the world works' that could easily spectacularly backfire.
- donkarma 5y ago
  unfortunate username for gmaxwell
binarynate 5y ago
"I deeply, deeply regret to inform you that this is the rap video of the woman who was just arrested as part of an alleged husband-wife scheme that laundered some $3.6 billion in crypto." https://twitter.com/kevincollier/status/1491107221857796097 https://twitter.com/kevincollier/status/1491107221857796097
- deleted 5y ago
  [deleted]
- sharkweek 5y ago
  I have been writing an imaginary Coen brothers in my head over the last couple of years based on absurd current events. This is definitely being added. I'm thinking of tying them both in as friends of Lady Gaga, tasked with trying to pay the ransom to the people who kidnapped her dog in crypto. In the process, they accidentally stole too much.
johnmarcus 5y ago
What i love most about this is that if these clowns didn't stupidly store their keys in a decrypt-able file in cloud storage, then ~.01% of BTC could have been lost forever. We are just 10,000 hacks away from bitcoin being gone forever! A boy can dream.
TacticalCoder 5y ago
So Bitfinex is worth at least $3.6bn or is it all customers BTCs? Were people made whole back then? Is it some MtGox thing where people who lost money back then will now have it? In BTC? Or in USD at the worth of BTC back then? Or in USD at today's BTC valuation?
- elkos 5y ago
  USD at today's BTC valuation. Would be approx $70m at the time of the hack.
facorreia 5y ago
"This is largely symbolic, but it does send a clear message. Like it or hate it, there is a sea change happening in how governments treat cryptocurrency." https://news.ycombinator.com/item?id=29111446#29111572 https://news.ycombinator.com/item?id=29111446#29111572
- drubio 5y ago
  Talk about famous last words, 3 month ago before this hammer came down, wow! Wonder if it crossed his mind if this also applied to his own crypto deals
dracodoc 5y ago
Page 15 of statement_of_facts The only other significant deposit to the account was an approximately $11,000 U.S. Small Business Administration Paycheck Protection Program (PPP) loan advance provided in response to the COVID-19 crisis. So they also applied for PPP.
d--b 5y ago
That's 3 times bigger than El Chapo's fortune. And it's still missing 900 millions!
amazd 5y ago
Here's a video of the couple, with the dude getting a hair cut from the rapper gf: https://www.youtube.com/watch?v=pDY1bC9eL-A https://www.youtube.com/watch?v=pDY1bC9eL-A
- tradertef 5y ago
  She says she is Turkish and counts in Turkish. But her name and accent are not Turkish..
  - tradertef 5y ago
    Her mom is Turkish.
trizuz 5y ago
pizzalife 5y ago
This goes to show that the only use case for NFTs is to launder money, and it's not exactly a great way of doing it. I hope they get a long prison sentence.
- bleachedsleet 5y ago
  Read the article, then please tell me what this has to do with NFTs?
  - pizzalife 5y ago
    Read the affidavit from the special agent. https://www.justice.gov/opa/press-release/file/1470186/download https://www.justice.gov/opa/press-release/file/1470186/downl... "Between the 2016 hack and the present, LICHTENSTEIN and MORGAN further engaged in a diverse array of virtual currency transactions, including transacting in numerous altcoins, liquidating BTC through a BTC ATM,23 and purchasing non-fungible tokens (NFTs)."
syspec 5y ago
> Here's how the fed caught them: > "The DOJ said it was able to seize the funds after an FBI search warrant of one of Lichtenstein's cloud storage accounts found a file containing cryptocurrency addresses and their corresponding private key that granted access to funds stored within." That makes sense, and of course storing them in cloud storage was a bad idea. However they could have only obtained the warrant /after/ they pretty much knew Lichtenstein was the culprit. How did they determine Lichtenstein was the person who had the bitcoins?
- thematrixturtle 5y ago
  Given that these clowns were not exactly low profile about their wealth, I imagine their opsec was less than optimal.
  - syspec 5y ago
    That could be true, but it still doesn't really answer the question. How did the FBI know, hey he's the guy, lets get a warrant
    - briantakita 5y ago
      It doesn't matter. They got a Bitcoin Billionaire in a trial. Guilty or not, they already won this round.
throwthere 5y ago
Oh wow. So will this $$ go back to bifinex and make tether solvent?
deleted 5y ago
[deleted]
archivebymanis 5y ago
For those who are blocked by the paywall - https://webreader.app/?url=https://www.washingtonpost.com/national-security/2022/02/08/bitfinex-hack-bitcoin-arrests/ https://webreader.app/?url=https://www.washingtonpost.com/na...
deleted 5y ago
[deleted]
briantakita 5y ago
The biggest crooks in the world just stole $3.6B & nobody arrested them.
paulpauper 5y ago
They could not prove that they are the ones who did the hack, only laundered the money.
archibaldJ 5y ago
Great to see this; once again reminds me to stay away from BS friends in insurance, etc, that talks about "tech" but smells con-artist and pretentious in general, even if you two used to grow up together Can't trust them if they are lost in the money game
nikolay 5y ago
Wake me up if somebody steals this kinda real money from a real bank.
mdoms 5y ago
Some of the videos coming out from one of the offenders are unbearably cringe. https://twitter.com/jackdwagner/status/1491141362707996672 https://twitter.com/jackdwagner/status/1491141362707996672 https://twitter.com/jackdwagner/status/1491140930090717184 https://twitter.com/jackdwagner/status/1491140930090717184 https://twitter.com/rudy_betrayed/status/1491225062984531968 https://twitter.com/rudy_betrayed/status/1491225062984531968
deleted 5y ago
[deleted]
jakobov 5y ago
Does anyone know how the BTC were stolen in the first place? Was the vulnerability found?
cestith 5y ago
This would seem to strike a blow to the "access equals ownership" camp of the blockchain coin folks.
KETpXDDzR 5y ago
I really don't get why they didn't encrypt their data. It's very easy nowadays and doesn't even degrade performance much (depends on algorithm used though). Especially when you place highly critical data in a cloud. Maybe they fell for the saying "Bitcoin is anonymous" - which it isn't, rather quiet the opposite.

698 points by mikeyouse 5y ago

Does anyone know if Bitfinex will get this returned to them (and hopefully repay users) .. or what the next steps in this story might look like?

spywaregorilla 5y ago
What users?
- ratg13 5y ago
  Bitfinex had to take a percentage of user's assets away due to the theft.
evdubs 5y ago
After this hack, Bitfinex account holders took a haircut (30% or so) and were given tokens representing the remainder of their dollar-denominated account balances. Those tokens were paid in full in 2017ish. Later, the UK, Portugal, and Poland seized $1B or so of Bitfinex customer funds due to the funds being delivered by Crypto Capital Corp who was found to be engaged in money laundering. Bitfinex issued LEO tokens to make up for that asset seizure, and have a clause that if the 2016 stolen bitcoins were recovered, they'd be used to retire the LEO tokens. That's why LEO has greatly increased in value recently. https://cryptowat.ch/charts/BITFINEX:LEO-USD?period=1d https://cryptowat.ch/charts/BITFINEX:LEO-USD?period=1d
- johnmarcus 5y ago
  It's so odd that the story breaks today but LEO started jumping 8 days ago. No insider trading there, I am certain!
  - deadbunny 5y ago
    IIRC the coins moved about a week ago. Wouldn't surprise me if there was some speculation that they had been seized leading to some speculation.

JoeAltmaier 5y ago

With so much money involved, I wonder if we can ever really know anything. Enough money, and you can make black == white. E.g. these two were fallguys

d23 5y ago
Thankfully we have a legal process intended to figure this exact thing out via a process of presenting and considering evidence.
- JoeAltmaier 5y ago
  And we don't think money comes into that?

mikeyouse 5y ago

> The Justice Department announced Tuesday it had seized more than $3.6 billion in bitcoin allegedly stolen as part of a 2016 hack of Bitfinex, saying authorities have also arrested and charged a husband and wife in New York for allegedly trying to launder the cryptocurrency fortune. > Officials said Ilya Lichtenstein, 34, and his wife, Heather Morgan, 31, were arrested on charges of conspiring to launder money. They are accused of trying to launder 119,754 bitcoin that were stolen after a hacker breached Bitfinex, a cryptocurrency exchange, and initiated more than 2,000 unauthorized transactions. Prosecutors said the bitcoin was sent to a digital wallet controlled by Lichtenstein. From the actual charging statement (https://www.justice.gov/opa/press-release/file/1470186/download?utm_medium=email&utm_source=govdelivery https://www.justice.gov/opa/press-release/file/1470186/downl...), the Feds have more details and fascinating traces through the various methods which the accused laundered the funds. Raises the question of whether they would've attracted so much attention if it were "only" a $70M hack instead of the multibillion dollar one due to BTC appreciation. > In or around August 2016, a hacker breached Victim VCE’s security systems and infiltrated its infrastructure. While inside Victim VCE’s network, the hacker was able to initiate over 2,000 unauthorized BTC transactions, in which approximately 119,754 BTC was transferred from Victim VCE’s wallets to an outside wallet. At the time of the breach, 119,754 BTC was valued at approximately $71 million. Due to the increase in the value6 of BTC since the breach, the stolen funds are valued at over $4.5 billion as of February 2022.

danso 5y ago

The statement of facts is linked to from the press release, and describes generally how the Feds were able to trace the stolen funds (they found a file listing private keys, after gaining access to the suspect's cloud storage) https://www.justice.gov/opa/press-release/file/1470186/download https://www.justice.gov/opa/press-release/file/1470186/downl... > The 2017 transfers notwithstanding, the majority of the stolen funds remained in Wallet 1CGA4s from August 2016 until January 31, 2022. On January 31, 2022, law enforcement gained access to Wallet 1CGA4s by decrypting a file saved to LICHTENSTEIN’s cloud storage account, which had been obtained pursuant to a search warrant. The file contained a list of 2,000 virtual currency addresses, along with corresponding private keys. > ...The connection among the VCE 1 accounts was further confirmed upon reviewing a spreadsheet saved to LICHTENSTEIN’s cloud storage account. The spreadsheet included the log-in information for accounts at various virtual currency exchanges and a notation regarding the status of the accounts > ...Lichtenstein Email 2 was held at a U.S.-based provider that offered email as well as cloud storage services, among other products. In 2021, agents obtained a copy of the contents of the cloud storage account pursuant to a search warrant. Upon reviewing the contents of the account, agents confirmed that the account was used by LICHTENSTEIN. However, a significant portion of the files were encrypted

colinmhayes 5y ago
$4 billion has got to buy an awful lot of compute time, but still, how did they decrypt the file?
- danjac 5y ago
  Private key was uploaded to cloud storage that Feds had access to with a search warrant.
- raverbashing 5y ago
  A fancy (or even basic) dictionary attack has a very high chance of working.
  - lupire 5y ago

fxtentacle 5y ago

Shouldn't all true crypto believers hate this news? It's the government trying to enforce their opinion of who should own those Bitcoins, thereby taking power away from the owner that the network has decided on, which would be "whoever has the cryptographic keys".

nathias 5y ago
how has anything changed in this sense? The owners of bitcoins are always whoever has the crypto keys, that isn't an imperative it's just a fact, now the fed has the keys.
gruez 5y ago
Seems like a win to me. The government had to physically go to their house and arrest them to get to their funds, whereas normally all they had to do was call up their bank and had their money frozen. Not to mention, this threat could have been easily mitigated by keeping your funds in a multsig wallet, with the keys distributed in multiple redundant locations.
- sschueller 5y ago
  Also crypto people have a problem with central banks manipulating currency by printing more etc. Having stolen coins recovered seems like an OK thing.
  - harambae 5y ago
    The classic libertarian adage is that a government powerful enough to give you everything you want is powerful enough to take everything you have. Some corollary would apply here. (it's not that anyone particularly loves letting criminals off the hook, it's granting that ability is a slippery slope)
- panarky 5y ago
  It's similar to privacy and surveillance. To secretly monitor a single individual's communications, law enforcement should have to get probable cause, present their case to a judge and obtain a court order. Dragnet surveillance of all communications all the time is a Very Bad Thing. Financial surveillance and seizure is currently at the Very Bad Thing stage and bitcoin helps move us back toward a better balance between the rights of the individual and the interests of the state.

albroland 5y ago

fwiw, it appears one of the named here is a YC Alum: https://news.ycombinator.com/user?id=il https://news.ycombinator.com/user?id=il https://www.linkedin.com/in/unrealdutch/ https://www.linkedin.com/in/unrealdutch/

rednerrus 5y ago
Andreessen roasting this guy all morning is making my day: https://twitter.com/pmarca/status/1491150099518398466 https://twitter.com/pmarca/status/1491150099518398466
- toomuchtodo 5y ago
  Replies to his tweet are just top notch. “your memes do have out-of-touch-dad-trying-to-be-cool energy tho”
- EVa5I7bHFq9mnYK 5y ago
  Wow, twitter went full pinterest now and refuses to let me read tweets without an account ...
zozbot234 5y ago
That's a nice username I guess.
deleted 5y ago
[deleted]
sydthrowaway 5y ago
Thin red line between scamming and hustling.
- optimalsolver 5y ago
  Well, yes. If you can socially engineer customer support staff, you can do the same to venture capitalists.

rasz 5y ago

"Today Ilya Lichtenstein is the co-founder of the Y Combinator backed Mix Rank," One of the first Google results for the names returns 'Get your first $1 million in enterprise sales with zero marketing spend' https://www.youtube.com/watch?v=DuIr5IFQ9Xg https://www.youtube.com/watch?v=DuIr5IFQ9Xg Heather R Morgan Serial entrepreneur SaaS Investor Razzlekhan = Surrealist Artist, Rapper & Fashion Designer with synesthesia Also Forbes writer https://www.inc.com/heather-r-morgan/dont-hire-a-salesperson-who-doesnt-have-these-traits.html https://www.inc.com/heather-r-morgan/dont-hire-a-salesperson... "As I build a sales team for my latest software startup, Endpass" Endpass "Bringing you the delightful and secure Ethereum wallet that's easy enough for grandma to use." Wait, so did Feds nab them for running Ethereum wallet startup and claim $3B in client wallets as theirs? Or did the pair start Ethereum wallet company to wash stolen coints?

duxup 5y ago
Did Mix Rank take bitcon?
ordinaryradical 5y ago
Were they married at the time of this interview?
gk1 5y ago
I met Heather many years ago. It's a weird feeling to see a name you recognize in an announcement like this. We've lost touch long since so I have no comment.
- capableweb 5y ago
  > We've lost touch long since so I have no comment But felt it was important enough to state that you know her? I'm not sure what your comment is supposed to be.
  - zkldi 5y ago
    jeez man, not every comment has to be a profound statement. I thought it was pretty interesting.

kisamoto 5y ago

In a hypothetical, if the two did not breach Bitfinex servers (unauthorized access to others systems) but instead managed to "guess" the private key to the Bitfinex wallet and transfer the funds, would this also be a crime? Would this be treated the same way?

runeks 5y ago
Wouldn't it still be laundering?
realce 5y ago
Computer Fraud and Abuse Act covers any unauthorized access regardless of how the credentials were obtained or... magically guessed.
- lupire 5y ago
  Also, grand larceny applies if you guess the code to unlock a car.
  - bpodgursky 5y ago
    It applies even if the car isn't locked... it applies any time you take something you know isn't yours.
- nybble41 5y ago
  In the scenario outlined there would be no unauthorized access to any systems, whether owned by Bitfinex or anyone else, so I really don't see how the CFAA could possibly apply here. As for the cryptocurrency network itself, the protocol is that anyone who has the private key is authorized to spend the corresponding funds—how the key was obtained is irrelevant. Of course, correctly guessing a 256-bit random private key is exceedingly unlikely, though if they key is based on a lower-entropy password (a "brain wallet") then the odds of a correct guess improve dramatically.
  - deleted 5y ago
    [deleted]

duxup 5y ago

>According to court documents, Lichtenstein and Morgan allegedly conspired to launder the proceeds of 119,754 bitcoin that were stolen from Bitfinex’s platform after a hacker breached Bitfinex’s systems and initiated more than 2,000 unauthorized transactions. Those unauthorized transactions sent the stolen bitcoin to a digital wallet under Lichtenstein’s control. Over the last five years, approximately 25,000 of those stolen bitcoin were transferred out of Lichtenstein’s wallet via a complicated money laundering process that ended with some of the stolen funds being deposited into financial accounts controlled by Lichtenstein and Morgan. Sounds like they were very much involved in the hack... or someone hacked Bitfinex and gifted them the coins?

mikeyouse 5y ago
Yeah -- It reads like they didn't have the evidence to prove they hacked Bitfinex, but plenty of evidence they're the only ones that moved the hacked funds. Hence the lack of CFAA or other charges in favor of money laundering ConFraudUS.

loceng 5y ago

I ask this every so often during threads regarding stolen cryptocurrency: Is there any solution yet to preventing stolen cryptocurrency funds from being spent? Isn't the only solution to have a central database and require laws to require every transaction to be pre-checked to see if it's stolen funds or not? And not only that, the centralized system will have to be constantly keeping track of wallet mixing to see where funds are being redirected to, attempted to being washed to?

pcthrowaway 5y ago
With some things, such as the stablecoin USDC, the issuer can prevent specific addresses from transferring them
- runeks 5y ago
  Which is only possible because it's centralized
  - knownjorbist 5y ago
    A DAO could just as easily decide to do the same, but it'd need to be built into the smart contracts.
    - pcthrowaway 5y ago
      This works with the smart contracts with USDC, it's just that there's an authority which has permission to update the state to deny transfers from a specific address. This is because USDC is a centralized stablecoin (as is USDT). There are decentralized stablecoins such as UST and MIM (and I believe DAI as well).
      - knownjorbist 5y ago
        Correct, though on second thought, given how slow many DAOs are to operate, the perpetrators would already be in some other uncontrollable currency by the time people voted to blacklist certain wallets.

throwaway110535 5y ago

25 years max for stealing billions? God bless America. > Lichtenstein and Morgan are charged with conspiracy to commit money laundering, which carries a maximum sentence of 20 years in prison, and conspiracy to defraud the United States, which carries a maximum sentence of five years in prison. A federal district court judge will determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.

twox2 5y ago
Are you suggesting that's a light punishment?
- throwaway110535 5y ago
  Given that folks have been given longer punishments for stealing less, yes. Granted, ianal and I acknowledge that things come into play like repeat offenses, etc.
  - twox2 5y ago
    At the same time, though, folks get lighter sentences for rape and murder. IMO there's nothing 30,40,50+ years can do to a person that 25 can't.
    - throwaway110535 5y ago
      touché
gruez 5y ago
>25 years max for stealing billions? 1. The bitcoins were only worth ~$70 million at the time of theft. saying they stole "billions" is highly misleading 2. I don't get it, aren't we supposed to be getting less "tough on crime", especially for non-violent offenses?
- throwaway110535 5y ago

throwaway9191aa 5y ago

I'm not well versed in BTC, so my prices may be wrong. But this is webscale in a way I haven't thought of before. It is alleged they stole 119754 BTC, which in 2016 was < $1000USD. Which would have been < $100,000,000. Today, it is worth 5bln. (not that 100mm is nothing.... but it is a lot less). Could you imagine stealing something that most people thought was a toy. Suddenly it became so valuable that the government could justify who-knows-how-much resources to catch you?

ilamont 5y ago

Are there any cases involving theft of this scale (or even 1/10th of this scale) that have been successfully prosecuted in the U.S.?

elkos 5y ago
The scale was around $70mil at 2016.

openhandcrimp 5y ago

It seems that Tornado Cash (https://tornado.cash/ https://tornado.cash/) could have been used to launder the funds. I wonder if: - Laundering happened before Tornado Cash existed, so Tornado Cash was not used - They used something like Tornado Cash, but the funds were still traceable

gruez 5y ago
As other commenters have noted, they stored the public/private keys on a cloud drive. A coin mixer isn't going to save you from that.
runeks 5y ago
Are you using Tornado Cash to launder money?
- gruez 5y ago
  Yeah wtf, I'm not sure why he's randomly namedropping it.
  - openhandcrimp 5y ago
    I don't understand why you are being so aggressive. This is a post about news on laundering crypto. I am aware of a technology that seems to cater to that use case.
    - jhugo 5y ago
      I would assume that it's because your comment reads like an advertisement, since it name-drops (and links to) a specific mixer rather than just saying "It seems that a coin mixer could have been used..." Is there anything novel about this particular mixer? If not, why link to this one specifically?
- openhandcrimp 5y ago
  I am personally not, but don't you think that use case is obvious?

mgh2 5y ago

Dupe: https://news.ycombinator.com/item?id=30260987 https://news.ycombinator.com/item?id=30260987

mdoms 5y ago

> “Today, federal law enforcement demonstrates once again that we can follow money through the blockchain, and that we will not allow cryptocurrency to be a safe haven for money laundering or a zone of lawlessness within our financial system,” said Assistant Attorney General Kenneth A. Polite Jr. of the Justice Department’s Criminal Division. How is this not a total death blow for bitcoin? If the justice department can do it, anyone can. It's a public ledger. So you effectively must treat every transaction you ever make on the blockchain as totally public and tied directly to you.

vmception 5y ago
Because there is a weak link in the methods these guys used. The DOJ always pats itself on the back to pretend to the worldwide audience that there is "no" illicit money in the US financial system. They don't say "good thing they didn't use X method! that would have hampered our investigation irreparably!" at least not in press releases.
AlexanderTheGr8 5y ago
It took them 6 years to catch these perps. And these perps were extremely sloppy (storing keys in cloud, weak encryption) Justice must give the perception that they are doing enough. They can't really say that it's really hard to catch people committing crimes in cryptocurrencies.

AlexanderTheGr8 5y ago

> “After the execution of court-authorized search warrants of online accounts controlled by Lichtenstein and Morgan, special agents obtained access to files within an online account controlled by Lichtenstein,” the press release said. “Those files contained the private keys required to access the digital wallet that directly received the funds stolen from Bitfinex, and allowed special agents to lawfully seize and recover more than 94,000 bitcoin that had been stolen from Bitfinex. The recovered bitcoin was valued at over $3.6 billion at the time of seizure.” So most likely, 1) they didn't launder it properly, leading to police being able to trace it to their bank accounts. I wonder if tornado.cash was used. 2) then police had their names, leading to warrants for all online accounts - google account, apple account, etc. 3) they made the big blunder of keeping their private keys in their online account. Most likely a txt file in google drive. That is such a silly blunder. Without the private keys, the police has zero proof of anything. They could have made a hundred excuses for how they got money in their bank account, as long as the police didn't have the private keys. Who keeps their private keys in an online account? Apparently the biggest criminals make too many silly mistakes. The old saying applies here: "you don't have to be smart, just don't be an idiot"

duxup 5y ago
Well you don't want to lose those keys ... there is a bit of a conundrum there (granted you don't have to do it the way they did either). As far as how exactly they got caught, there was a reward offered by the company it was stolen from. It may have been someone tipped the feds off for the reward.
- AlexanderTheGr8 5y ago
  Crypto 101: never store private keys online.
  - giaour 5y ago
    Crypto 102: weep for the coins you lost when your cousin spilled soda on the hard drive containing the offline-only copy of your private keys

caseysoftware 5y ago

I'm sitting here trying to understand their mindset. They had to know what kind of scrutiny would be on those coins forever. At the time of the theft, the coins are worth $100M+ and they can't touch them. Even worse, anything they do with them will be monitored, researched, dug into, and everything else from law enforcement, amateur detectives, and every major tech+crime group. Fast forward to now and the coins are worth 50x that.. and now they try to move them? And all the keys are in cloud storage? But it had to be frustrating to be sitting on something so valuable without any way to use it. They had to be stressed and anxious about it. A life of crime is stupid. A life of crime for something this high profile is far beyond stupid.

duxup 5y ago
I was wondering about this. I would think the most obvious path would be to find some other criminals (now you've got new risks) who don't care about the provenance of the coins, will pay cash for some coins at a discount, and you somehow launder that cash.... Could at least get a couple bucks from it, possibly.
- tannhauser23 5y ago
  There are "local bitcoin trading" groups that do exactly this - convert bitcoin to cash at a discount. But obviously you can't do this for billions of dollars and you expose yourself to personal monitoring and capture.
  - giaour 5y ago
    I'd bet there's a non-zero chance your exchange counterparty at one of these groups is an undercover cop.
- hedora 5y ago
  On the one hand, the mob would probably be happy to buy them for 10-30% face value. On the other hand, how do you contact a reputable mob boss?

shiado 5y ago

It never ceases to amaze me how incompetent some high profile criminals are. Encrypting a file is simply too difficult apparently. The entire purpose of crypto is that the exclusive holder of a private key cannot have funds seized. A 15 year old kid probably has better opsec with their crypto wallets than these people. Astonishing really.

vmception 5y ago
yeah I've never seen a crypto investigation that made me impressed with the government's abilities, nothing that surprised me about the utility of OPSEC best practices, only people with weak links and dumb behaviors that are incompatible with doing something criminal.
- from 5y ago
  You're not serious, right? You clearly haven't seen some of the latest unlicensed money transmitter prosecutions. The resourceful agents over at HSI have come up with an incredibly effective method of stopping crime in the Bitcoin network. It looks something like: CS1: "I would like to exchange these dollars which I represent to be the proceeds of the sale of controlled substances in violation of the Controlled Substances Act for Bitcoin." Localbitcoins trader: "OK."
  - vmception 5y ago
    4D Quantum Chess right there

lbriner 5y ago

Serious question though, we live in a time when a mere mortal is able to carry out an enormous financial crime, whose knock-on effects could be enormous to millions of people directly and indirectly. How do you put a relevant sentence on that? Even whole-life in prison doesn't really make up for the number of people who might be affected by it. note, I didn't read the article, it was just the headline that made me ask the question so possibly slightly off-topic.

vmception 5y ago

> “digital currency heists executed through complex money laundering schemes could undermine confidence in cryptocurrency,” said U.S. Attorney Matthew M. Graves Well now you US prosecutors aren't reading hacker news!

vmception 5y ago
now you ^know

deleted 5y ago

[deleted]

nodesocket 5y ago

Does this mean users who lost everything on bitfinex will be contacted and could possibly recover their coins? Can you imagine waking up to realize you are rich because the feds seized the coins and are returning to you.

deleted 5y ago
[deleted]
paulpauper 5y ago
It means the BTC will re-enter market eventually , so not good for longs.
chaoz_ 5y ago
Fascinating way to HODL to the token indeed.

joshbaptiste 5y ago

Why would a Russian national with so much BTC to launder, who hasn't touched it in 6 years suddenly perform the action from New York City of all places from within the USA.

miohtama 5y ago
It is explained in the court documents. Please read the PDF.
- rosndo 5y ago
  It really isn’t.
polynomial 5y ago
Ilya is a Russian national? (Sorry, I hadn't sees that mentioned yet.)
- mikeyouse 5y ago
  Yep - dual citizen. Though via his LinkedIn, he went to at least High School and College in the US.
pavel_lishin 5y ago
I don't know why people assume that Russia is a lawless land where you can just cash out billions of dollars worth of stolen cryptocurrency. Even if that were the case, maybe they rationally decided that the risk of pissing off United States federal authorities was better than pissing off Russian authorities and organized crime.

paulpauper 5y ago

Not a a lone Russian hacker, but American citizens..a husband and wife couple. crazy.

dcist 5y ago
the husband is Russian-American

deepsun 5y ago

Should I expect price drop once feds start to sell it? Or they'll just destroy the keys (keeping the money invested forever).

lern_too_spel 5y ago
It will probably be returned to Bitfinex if they can access the wallet.
- bastawhiz 5y ago
  That's assuming the feds don't have unfinished business with Bitfinex. They're not exactly on great terms.
  - lern_too_spel 5y ago
    That's just nitpicking. If Bitfinex is acting as a custodian, the property will be returned to the owners. Whether that return happens via Bitfinex or via the feds looking at Bitfinex's books doesn't really change much. The point is that the feds can't destroy property just because they don't like who it was stolen from.
    - bastawhiz 5y ago
      The feds have no problem seizing and liquidating property. They do it all the time. They even recruit local law enforcement to do it for them. See "equitable sharing"
      - lern_too_spel 5y ago
        That's if the property was purchased using money obtained from selling illegal goods or services. If the property doesn't belong to the criminal, it's an entirely different situation.
Lev1a 5y ago
I'd actually really like if they used this opportunity to drive the Bitcoin price straight into the ground, thereby ruining that market for all those speculative investors. Maybe that'd allow for something of a reboot of the ecosystem having eliminated the scum that usually starts to invade any remotely financially exploitable system after a while.

mittermayr 5y ago

Sometimes I wonder what the chances are that certain (highly privileged) staff at Google (or other similar data storage or e-mail companies) could run a query across Google Drive looking for a specific public key. Much like a malware scanner, just looking for "a key", just to see if there is an account matching. Unofficially, of course. A rogue employee perhaps. And, what if, in such a case, the employee (in the best of cases) reports the person anonymously, or in other cases, takes off with the private key if also found. Or does anyone know if the data is so encrypted that nobody at Google can override? I would highly doubt that, looking at US law enforcement pressure. And I am sure there's a million and one barriers and access requests blocking raw queries, but technically... Of course, a hefty hefty conspiracy-laden thought, but I just found myself curious if that would even remotely be an option.

bagacrap 5y ago
I think the perp encrypted the file themselves before uploading to Google cloud (or wherever). The encryption was not provided by the platform.
paulpauper 5y ago
this would be trivial to code and could search for one of the bip 39 dictionary words. github key thieves do this already.
- vmception 5y ago
  Happened to many on dropbox too You would never know if it was somebody employed there or at the data center or at the government agency tapping the servers
  - dannyw 5y ago
    Yep, I definitely recall numerous incidents of people putting a private key onto a dropbox file, never sharing it with anyone, have 2FA on their accounts (with no unauthorized activity), and then seeing funds disappear.
5y ago

jrav 5y ago

Probably stupid question: Why not just exchange it to zcash or monero or some other coin that hides transaction details? Then you can send it to a new wallet; theoretically 100% untraceably. Is this not a valid approach?

miohtama 5y ago
If you read the court PDFs you see that they tried it.
AlexanderTheGr8 5y ago
One possibility is that almost all exchanges require KYC today.
uncomputation 5y ago
The transaction from BTC to Monero is traceable.
- cirowrc 5y ago
  with atomic swaps that make use of taproot, that wouldn't be distinguishable from, say, opening a lightning channel, but still, there's not enough liquidity there (and this is very recent stuff anyway)
Gasp0de 5y ago
They did that apparently, it is mentioned in the article. There are still ways to trace it. For example, if they do it in a short timeframe or in just two transactions you can match the amounts. Not many people send 100k$ in zCash around.
- 0des 5y ago
  Amounts are not public with Monero outputs created within the last few years.
  - benreesman 5y ago

vmception 5y ago

> charged with conspiracy to commit money laundering, and conspiracy to defraud the United States Do you think there are more charges to come? If they think they actually laundered money through businesses, why didn't they charge them with multiple counts of money laundering and multiple counts of wire fraud and a violation of the CFAA?

vmception 5y ago
I’m actually wondering if there are serious doubts here. Especially due to the weaker charges levied, and watching the cringy @realrazzlekhan tiktok page where everyone also has their doubts about these people’s competence. Darknet markets sell IDs, the DOJ also says the hackers used fake IDs to reintegrate the money. This fairly welloff couple (lives in Manhattan condo, owns bengal cat and jewelry) could easily just be one of the IDs. Both the husband and wife are early crypto proponents but that might just be circumstantial to both the DOJ and the hacker who got their IDs. Watching this one. Its like they got just enough of data for a charge to get the subpoenas and warrants, but not enough to go for the bigger more damning charges.
- seibelj 5y ago
  If you read the complaint it is pretty clear they were at least heavily involved. Their personal accounts and businesses were tied up into it.
  - vmception 5y ago
    I’m still reading it They definitely had custody of the funds and felt obligated to try and launder it It seems like the government needs to figure out if they were the only ones with custody, which is proving a negative with private keys, but the government seems to feel like it’s needs a greater proof of the actual heist of bitfinex so they can pin the rest on this couple. Still reading though, this is just what I’ve parsed so far. The IRS-CI agent had requested CFAA and Wire Fraud charges.
    - 5y ago

nathias 5y ago

should have used monero

emerged 5y ago

This is the type of hack you need to be both smart enough and dumb enough to commit.

pdog 5y ago

Ilya Lichtenstein (YC S11) is the co-founder of YC-backed MixRank. Heather Morgan, his wife, is apparently a serial entrepreneur, investor, and "contributor" to Forbes.

cam0 5y ago
Her Forbes bio: Heather R. Morgan is an international economist, serial entrepreneur, and investor in B2B software companies. She is an expert in persuasion, social engineering, and game theory.
- rasz 5y ago
  she also ran Endpass "Bringing you the delightful and secure Ethereum wallet that's easy enough for grandma to use."
- robbedpeter 5y ago
  "The infamous Crocodile of Wall Street" lol. They certainly thought an awful lot of themselves - it's fascinating to dig into their public facing digital trail. If they played by the rules they'd have been living large as part of the .001% of the world. They bought themselves a giant lead brick and chained themselves to it. It'd be sad if it weren't so stereotypically comical.
localhost 5y ago
She's also a rapper, and not a very good one: https://www.youtube.com/watch?v=_DIuPPmY9mw https://www.youtube.com/watch?v=_DIuPPmY9mw
- outside1234 5y ago
  "0FCKs given" This whole crypto space is just a giant show of "Punk't" isn't it. This can't be real - it is just parodies the whole way down.
- 323 5y ago
  Doesn't matter, she's going viral now

FDSGSG 5y ago

So uh, does this money get returned to Bitfinex now? Is this a huge windfall for them? They've fully redeemed their BFX tokens for whatever that's worth.

Severian 5y ago

So, hypothetically, if these guys were to completely cash out these coins somehow, and then pay tax to the IRS, would they be immune from tax fraud and IRS involvement? I know similar things happen with stolen property and illegal drugs (Sullivan v. United States).

vmception 5y ago
Yes if they successfully laundered it and paid taxes they would have no liability.
- Severian 5y ago
  Probably liability to the Fed, but not local prosecutors for whatever locality Bitfinex was in then? Are bitcoins recognized as personal property, IP, none, or something of a blend in smaller jurisdictions? I have no idea.
  - vmception 5y ago
    they wouldn’t know who to hold accountable either. The point is that nobody would. In my model the only liability would occur from the normal day to day business operation that you earn the successfully laundered proceeds from. like one of your actual clients sue you because you breached the SLA because you forgot you’re actually running a legitimate business.

300bps 5y ago

The hack occurred 5.5 years ago. The Federal statute of limitations on Grand Theft/Larceny is 5 years. Is this why they are charged with Conspiracy to Commit Money Laundring and not charged with the actual theft? Lichtenstein and Morgan are charged with conspiracy to commit money laundering If so, this means that (outside tax obligations) they may have gotten away with it essentially by sitting on the money doing nothing for 5 years and then openly transferred it to themselves. Since they took actions that were meant to launder the money, they opened themselves up to the money laundering charges on their own. https://www.law.cornell.edu/uscode/text/18/3282 https://www.law.cornell.edu/uscode/text/18/3282 This is similar to many financial regulations where you can have completely legally obtained money but if you deposit $9,000 followed by depositing $1,000 thereby avoiding a CTR notification to the government required for a $10,000 deposit, you're guilty of "structuring" your deposits. https://www.fincen.gov/sites/default/files/shared/CTRPamphlet.pdf https://www.fincen.gov/sites/default/files/shared/CTRPamphle...

deleted 5y ago
[deleted]
peter303 5y ago
Structured transactions dont have an amount threshold. Former Speaker of the House Hastert got jail for sub-threshold transactions.
mikeyouse 5y ago
It's definitely not that easy... They would be sued in Civil Court for the entire amount, the Feds have a variety of options for 10-year statutes that could be implicated when they transfer the funds to a bank (wire fraud, mail fraud, bank fraud) and they would have to pay taxes on the funds lest they are implicated in tax fraud. It's hard work being a criminal.

counternotions 5y ago

Wow can't wait for this book.

peter303 5y ago
Or the movie. Who should play Lichtenstein?

onemoresoop 5y ago

Will this make bitcoin plummet? I figure that all these stolen stashes of BTC lowered the supply on the market and with these new available coins it will plummet somewhat.

ericmay 5y ago

Beautiful. Kudos to the FBI and the US Government for nailing these criminals.

jupblb 5y ago

And to think ~10 years ago it was subject of a joke to call police because of theft of fictional online goods [1]. [1]: https://www.youtube.com/watch?v=jSyjcib_Fps https://www.youtube.com/watch?v=jSyjcib_Fps

JumpCrisscross 5y ago

What possesses someone who just stole billions to stay in New York while trying to launder their money? Staying and pretending it didn't happen, I get. Pulling a Marsalek, I get. But staying? While continuing to try and access that wealth? Is it arrogance? Stupidity? Misplaced faith in the anonymity of crypto?

abvdasker 5y ago
Reminds me of Ross Ulbricht getting busted for running Silk Road. If you're running the largest black market for drugs in human history, why in the world would you stay in San Francisco???

deleted 5y ago

[deleted]

neonate 5y ago

http://web.archive.org/web/20220208165810/https://www.washingtonpost.com/national-security/2022/02/08/bitfinex-hack-bitcoin-arrests/ http://web.archive.org/web/20220208165810/https://www.washin... https://archive.is/IcdPK https://archive.is/IcdPK

AlexanderTheGr8 5y ago

> One overlooked detail in the Razzlekahn arrest. Almost all the money went through AlphaBay, using it as a mixer. The feds were able to see through this because they seized AlphaBay. Its amazing how, even years after, darknet market seizures pay dividends to the feds. Another fascinating detail. Source: https://twitter.com/ncweaver/status/1491118233973571585 https://twitter.com/ncweaver/status/1491118233973571585

vmception 5y ago
Why do they call it Razzlekahn? I was just watching her tiktok account, pure cringe.
- sharken 5y ago
  Razzle looks like a female version of the male rapper Rahzel, who is also from New York. https://en.m.wikipedia.org/wiki/Rahzel https://en.m.wikipedia.org/wiki/Rahzel And Khan is from Genghis Khan, as mentioned here: https://www.lyrics.com/sub-artist/Razzlekhan/28366 https://www.lyrics.com/sub-artist/Razzlekhan/28366 But this is all just a guess.
young_unixer 5y ago
Another reason why Monero is better. With Monero, it wouldn't have mattered that AlphaBay was hacked.
- 323 5y ago
  Funny you would say that, because if you read the indictment, these people did actually deposit Monero on one exchange: > VCE 4 Account 2 was entirely funded by approximately 13,200 XMR via approximately 21 transactions that took place between in or around November 2017 and March 2019. > Another account at VCE 4 (“VCE 4 Account 3”) was created on or about November 20, 2017, and was registered in the name of another Russian national and under another Russian email address. VCE 4 Account 3 was entirely funded by approximately 6,870 XMR, via approximately 10 transactions that took place between in or around November 2017 and April 2019. > The XMR deposited into VCE 4 Account 2 and VCE 4 Account 3 was all converted to BTC and then withdrawn, consistent with chain hopping. The same method was used to liquidate the funds from the VCE 1 accounts as described above.

dannylandau 5y ago

So, who did the hack? And why did original hacker transfer funds to Lichtenstein?

deleted 5y ago
[deleted]

jnwatson 5y ago

This is a great argument for Monero. It is much easier to launder money on a privacy-oriented blockchain.

maboo 5y ago

Ilya is a good guy, I don't think he's guilty. there's gotta be a misunderstanding everyone thinks this story is about me

elkos 5y ago
How are you involved in this story?
- coolspot 5y ago
  > editor on rapgenius.com There is a rapper involved in the case.

mrkramer 5y ago

>Hackers Move $3.55B Worth of Bitcoin from 2016 Bitfinex Hack https://news.ycombinator.com/item?id=30162085 https://news.ycombinator.com/item?id=30162085 So government was moving bitcoins not hackers. Like I said in that thread it is easier to launder cash than bitcoins because bitcoins are on chain forever and cold cash can be laundered in numerous ways.

tradertef 5y ago
Thanks for sharing this. Hilarious comments :)

gzer0 5y ago

Here's how the fed caught them: "The DOJ said it was able to seize the funds after an FBI search warrant of one of Lichtenstein's cloud storage accounts found a file containing cryptocurrency addresses and their corresponding private key that granted access to funds stored within."

newbie789 5y ago
kart23 5y ago
what the... no way they just kept an unencrypted private key on the cloud.
- johnmarcus 5y ago
  the file was encrypted, but the fbi hacked it after already having gained access to the account (via warrent). Which is to say, this isn't how they actually got cought, it's just how the nail will go in the coffin (and thankfully for those impacted, some funds recovered). FWIW, if you ever find yourself in this position of owning a large amount of stolen crypto, I believe the best way to wash it would be to "robin hood it out" to a bunch of random wallets. You just happen to own 10-20% of the wallets, but the feds now have to try and track thousands of different people over years to try and identify the true thief, and there will always be plausible deniability.
  - ed 5y ago
    Interesting idea. But you’d only need to sample a small number of wallets to see the same person appear twice.
  - alfalfasprout 5y ago
    or buy extremely expensive tangible assets (diamonds, gold, bulk quantities of drugs). But billions of dollars worth? Forget it.
- manquer 5y ago

ncmncm 5y ago

nojito 5y ago
Sure if ignore the findings from Mueller.
teraflop 5y ago
Would you say the Senate Intelligence Committee report, which was released by a committee of 8 Republicans and 7 Democrats, and which found that: > Russian intelligence services' assault on the integrity of the 2016 U.S. electoral process[,] and Trump and his associates' participation in and enabling of this Russian activity, represents one of the single most grave counterintelligence threats to American national security in the modern era. was also entirely fabricated by the Clinton campaign?
pyronite 5y ago
> He snagged a Pulitzer for a story about something that never had any primary source, that was entirely fabricated by political operatives then working for Hillary Clinton's campaign. There was a multi-year government report indicating that "the Russian government 'interfered in the 2016 presidential election in sweeping and systematic fashion' and 'violated U.S. criminal law'." Source and further reading if desired: https://en.wikipedia.org/wiki/Mueller_report#Russian_interference https://en.wikipedia.org/wiki/Mueller_report#Russian_interfe... The Justice Department under former Attorney General Bill Barr tried to determine who had leaked to the reporter, Devlin Barrett, because the information he published was accurate and classified: https://www.washingtonpost.com/national-security/washington-post-trump-reporter-emails/2021/07/13/27c1f04e-e41f-11eb-b722-89ea0dde7771_story.html https://www.washingtonpost.com/national-security/washington-...
tomweingarten 5y ago
Do you have examples of false articles he published? I can't find any examples of work he's done that comes close to comparing to Roger Stone's crimes.
deleted 5y ago
[deleted]

counternotions 5y ago

The wife could plead not guilty by reason of insanity: https://twitter.com/matthewesp/status/1491116443207094272?s=21 https://twitter.com/matthewesp/status/1491116443207094272?s=...

johnmarcus 5y ago
have you seen her rap video? https://razzlekhan.com/ https://razzlekhan.com/ She should be arrested purely for subjecting people to its existence.

majani 5y ago

What's shocking to me is that the hack was actually real and not just an inside job by Bitfinex employees

mrkramer 5y ago
For example Mt. Gox hack was also most probably hack not an inside job because that guy Mark Karpelès was so incompetent running the exchange no wonder it got hacked every now and then.

modeless 5y ago

So what will happen to the coins? They'll probably be looking for any excuse to avoid giving billions back to Bitfinex. This will be fascinating.

peter303 5y ago
DOJ says they'll be returned to previous owners.
- modeless 5y ago
  Sure, but what does that mean? Will they return it to Bitfinex to distribute? Will they try to distribute it themselves? How will the accounting for who owns it work given Bitfinex's complex (and probably illegal under US law) token scheme that they implemented to cover up the hack? Will they return amounts calculated based on the value stolen in 2016, or the value of the coins now, a 60x difference? Will they sell the coins and transfer dollars to claimants, or transfer the coins directly?

tdhz77 5y ago

ilya@mixrank.com

subpixel 5y ago

"When she's not reverse-engineering black markets to think of better ways to combat fraud and cybercrime, she enjoys rapping and designing streetwear fashion." My online bio need some levelling-up. https://www.forbes.com/sites/heathermorgan/?sh=6e246df87f7d https://www.forbes.com/sites/heathermorgan/?sh=6e246df87f7d

latchkey 5y ago
https://www.youtube.com/watch?v=f5s4taHrEWA https://www.youtube.com/watch?v=f5s4taHrEWA
deleted 5y ago
[deleted]

joecool1029 5y ago

I was thinking, we know the feds have seized bitcoin and auctioned (laundered) them off later on. Cash often gets seized too. What happens if a criminal tries to burn cash and is mostly successful in doing so? Do the feds go to the BEP with a claim to get the money reprinted; or, like burned bitcoin, is it gone forever?

vmception 5y ago

> While it is possible that SalesFolk received virtual currency, based on my experience, companies that do offer virtual currency as a payment method or in conjunction with another service often advertise it to attract more business. Disagree here. I know many institutional funds that accept crypto for investment, solely because the third party fund administrator allows it, who only updated to account for that because so many funds and limited partners wanted that. You would have no idea how much is happening behind the scenes, with the merchant services pushes being just a small tip of an iceberg with its own success or failures.

soared 5y ago
I was going to disagree, but it turns out you’re right. Home Depot and a few other companies do accept crypto and they are not trying to meme about it.

m3kw9 5y ago

What happens to the seized bitcoins?

dorlevi 5y ago

"How to Social Engineer Your Way Into Anything — Heather R. Morgan | NYC Salon 101 " : https://youtu.be/JmahJCWJ8iM?t=1572 https://youtu.be/JmahJCWJ8iM?t=1572 Heather Morgan explaining how you can social engineer yourself out of a bad situation, can't make this shit up.

mmh0000 5y ago

More people needs to learn about CoinJoins[0]. "CoinJoin is a trustless method for combining multiple Bitcoin payments from multiple spenders into a single transaction to make it more difficult for outside parties to determine which spender paid which recipient or recipients. Unlike many other privacy solutions, coinjoin transactions do not require a modification to the bitcoin protocol." [0] https://en.bitcoin.it/wiki/CoinJoin https://en.bitcoin.it/wiki/CoinJoin

jacquesm 5y ago
Great idea, now you are not only liable for your own activities, but also for lots of other activities possibly much worse than your own. This seems to be a pretty nerdy idea of 'how the world works' that could easily spectacularly backfire.
donkarma 5y ago
unfortunate username for gmaxwell

binarynate 5y ago

"I deeply, deeply regret to inform you that this is the rap video of the woman who was just arrested as part of an alleged husband-wife scheme that laundered some $3.6 billion in crypto." https://twitter.com/kevincollier/status/1491107221857796097 https://twitter.com/kevincollier/status/1491107221857796097

deleted 5y ago
[deleted]
sharkweek 5y ago
I have been writing an imaginary Coen brothers in my head over the last couple of years based on absurd current events. This is definitely being added. I'm thinking of tying them both in as friends of Lady Gaga, tasked with trying to pay the ransom to the people who kidnapped her dog in crypto. In the process, they accidentally stole too much.

johnmarcus 5y ago

What i love most about this is that if these clowns didn't stupidly store their keys in a decrypt-able file in cloud storage, then ~.01% of BTC could have been lost forever. We are just 10,000 hacks away from bitcoin being gone forever! A boy can dream.

TacticalCoder 5y ago

So Bitfinex is worth at least $3.6bn or is it all customers BTCs? Were people made whole back then? Is it some MtGox thing where people who lost money back then will now have it? In BTC? Or in USD at the worth of BTC back then? Or in USD at today's BTC valuation?

elkos 5y ago
USD at today's BTC valuation. Would be approx $70m at the time of the hack.

facorreia 5y ago

"This is largely symbolic, but it does send a clear message. Like it or hate it, there is a sea change happening in how governments treat cryptocurrency." https://news.ycombinator.com/item?id=29111446#29111572 https://news.ycombinator.com/item?id=29111446#29111572

drubio 5y ago
Talk about famous last words, 3 month ago before this hammer came down, wow! Wonder if it crossed his mind if this also applied to his own crypto deals

dracodoc 5y ago

Page 15 of statement_of_facts The only other significant deposit to the account was an approximately $11,000 U.S. Small Business Administration Paycheck Protection Program (PPP) loan advance provided in response to the COVID-19 crisis. So they also applied for PPP.

d--b 5y ago

That's 3 times bigger than El Chapo's fortune. And it's still missing 900 millions!

amazd 5y ago

Here's a video of the couple, with the dude getting a hair cut from the rapper gf: https://www.youtube.com/watch?v=pDY1bC9eL-A https://www.youtube.com/watch?v=pDY1bC9eL-A

tradertef 5y ago
She says she is Turkish and counts in Turkish. But her name and accent are not Turkish..
- tradertef 5y ago
  Her mom is Turkish.

trizuz 5y ago

pizzalife 5y ago

This goes to show that the only use case for NFTs is to launder money, and it's not exactly a great way of doing it. I hope they get a long prison sentence.

bleachedsleet 5y ago
Read the article, then please tell me what this has to do with NFTs?
- pizzalife 5y ago
  Read the affidavit from the special agent. https://www.justice.gov/opa/press-release/file/1470186/download https://www.justice.gov/opa/press-release/file/1470186/downl... "Between the 2016 hack and the present, LICHTENSTEIN and MORGAN further engaged in a diverse array of virtual currency transactions, including transacting in numerous altcoins, liquidating BTC through a BTC ATM,23 and purchasing non-fungible tokens (NFTs)."

syspec 5y ago

> Here's how the fed caught them: > "The DOJ said it was able to seize the funds after an FBI search warrant of one of Lichtenstein's cloud storage accounts found a file containing cryptocurrency addresses and their corresponding private key that granted access to funds stored within." That makes sense, and of course storing them in cloud storage was a bad idea. However they could have only obtained the warrant /after/ they pretty much knew Lichtenstein was the culprit. How did they determine Lichtenstein was the person who had the bitcoins?

thematrixturtle 5y ago
Given that these clowns were not exactly low profile about their wealth, I imagine their opsec was less than optimal.
- syspec 5y ago
  That could be true, but it still doesn't really answer the question. How did the FBI know, hey he's the guy, lets get a warrant
  - briantakita 5y ago
    It doesn't matter. They got a Bitcoin Billionaire in a trial. Guilty or not, they already won this round.

throwthere 5y ago

Oh wow. So will this $$ go back to bifinex and make tether solvent?

deleted 5y ago

[deleted]

archivebymanis 5y ago

For those who are blocked by the paywall - https://webreader.app/?url=https://www.washingtonpost.com/national-security/2022/02/08/bitfinex-hack-bitcoin-arrests/ https://webreader.app/?url=https://www.washingtonpost.com/na...

deleted 5y ago

[deleted]

briantakita 5y ago

The biggest crooks in the world just stole $3.6B & nobody arrested them.

paulpauper 5y ago

They could not prove that they are the ones who did the hack, only laundered the money.

archibaldJ 5y ago

Great to see this; once again reminds me to stay away from BS friends in insurance, etc, that talks about "tech" but smells con-artist and pretentious in general, even if you two used to grow up together Can't trust them if they are lost in the money game

nikolay 5y ago

Wake me up if somebody steals this kinda real money from a real bank.

mdoms 5y ago

Some of the videos coming out from one of the offenders are unbearably cringe. https://twitter.com/jackdwagner/status/1491141362707996672 https://twitter.com/jackdwagner/status/1491141362707996672 https://twitter.com/jackdwagner/status/1491140930090717184 https://twitter.com/jackdwagner/status/1491140930090717184 https://twitter.com/rudy_betrayed/status/1491225062984531968 https://twitter.com/rudy_betrayed/status/1491225062984531968

deleted 5y ago

[deleted]

jakobov 5y ago

Does anyone know how the BTC were stolen in the first place? Was the vulnerability found?

cestith 5y ago

This would seem to strike a blow to the "access equals ownership" camp of the blockchain coin folks.

KETpXDDzR 5y ago

I really don't get why they didn't encrypt their data. It's very easy nowadays and doesn't even degrade performance much (depends on algorithm used though). Especially when you place highly critical data in a cloud. Maybe they fell for the saying "Bitcoin is anonymous" - which it isn't, rather quiet the opposite.