CASE DOSSIER
sentenced
U.S. v. Ilya Lichtenstein & Heather Morgan (Bitfinex Hack & Laundering)
Docket: 1:23-cr-00239 Court: U.S. District Court for the District of Columbia Opened: 2022-02-07 Sector: Cryptocurrency Exchanges, Financial Services
Key Facts
Status
SENTENCED
Legal disposition
Loss Amount
$4.5 billion
Stole 119,754 Bitcoins from Bitfinex; DOJ recovered 94,000 Bitcoins valued at $3.6 billion in the largest single financial seizure in U.S. history.
Techniques
1
Verified mappings
Defendants
2
Named in charges
- Legal Status: SENTENCED in U.S. District Court for the District of Columbia.
- Primary Target Sector: Cryptocurrency Exchanges, Financial Services.
- Documented Financial Loss: $4.5 billion.
- 1 verified MITRE ATT&CK techniques substantiated with verbatim court excerpts.
Export structured case data and MITRE ATT&CK Navigator layer:
Case Summary
Conviction of Ilya Lichtenstein and Heather Morgan for executing the 2016 hack of the Bitfinex virtual currency exchange, stealing 119,754 Bitcoins (valued at $4.5 billion at arrest), and laundering the funds through complex cryptocurrency mixers and darknet markets.
Procedural & Incident Timeline
2022-02-08 arrest
Lichtenstein and Morgan arrested in Manhattan by federal agents with recovery of 94,000 Bitcoins.
2023-08-03 plea
Defendants plead guilty to conspiracy to commit money laundering in D.D.C.
2024-11-14 sentencing
Lichtenstein sentenced to 60 months (5 years) in federal prison; Morgan sentenced to 18 months.
Named Defendants & Operatives
| Defendant | Nationality | Status | Prison Term | Restitution | Notes |
|---|---|---|---|---|---|
| Ilya Lichtenstein | United States | sentenced | 60 mo | None | Perpetrator of 2016 Bitfinex exchange intrusion; sentenced to 60 months in prison. |
| Heather Rhiannon Morgan | United States | sentenced | 18 mo | None | Conspirator in laundering 119,754 Bitcoins stolen from Bitfinex; sentenced to 18 months. |
Substantiated MITRE ATT&CK Techniques
| Technique ID | Technique Name & Tactic | Primary Source Evidence Excerpt | Locator | Verification |
|---|---|---|---|---|
| T1078 | Valid Accounts Defense Evasion | "Lichtenstein gained access to Bitfinex's internal systems and authorized over 2,000 fraudulent cryptocurrency withdrawal transactions to private wallets." | Statement of Offense ¶ 6, Page 3 | reviewed |
Cite & Embed This Case Record
Public Domain / CC0 Bluebook Legal Citation:
Cyberattack Case Library, U.S. v. Ilya Lichtenstein & Heather Morgan (Bitfinex Hack & Laundering), No. 1:23-cr-00239 (U.S. District Court for the District of Columbia 2022), https://cyberattackcaselibrary.pages.dev/cases/us-v-lichtenstein-bitfinex-heist-laundering/
Embeddable Incident Card (HTML):
<iframe src="https://cyberattackcaselibrary.pages.dev/embed/case/us-v-lichtenstein-bitfinex-heist-laundering" width="100%" height="220" style="border:none; border-radius:6px;" loading="lazy"></iframe>