Bitfinex Hacker Ilya Lichtenstein Should Serve 5 Years in Prison, DOJ Says

Prosecutors have requested that Ilya “Dutch” Lichtenstein, who pleaded guilty last year to the 2016 hack of crypto exchange Bitfinex, should spend five years behind bars for his crime.

Lichtenstein and his wife, Heather “Razzlekhan” Morgan, were arrested in Manhattan in February 2022 and charged with conspiring to launder nearly 120,000 bitcoins stolen during the hack. Though Lichtenstein and Morgan were first believed to only have laundered the proceeds of the hack (worth approximately $7.5 billion at today’s value), Lichtenstein later admitted to being the original hacker.

According to court documents, the couple successfully laundered 25,111 bitcoins – or 21% of the total pile Lichtenstein stole from Bitfinex – using a complex web of Eastern European bank accounts and bitcoin mixing services to hide the origin of the funds. Prosecutors told the judge that Lichtenstein and Morgan employed “the most complicated money laundering techniques [IRS agents] had seen to date.”

In August 2023, Lichtenstein pleaded guilty to one count of conspiracy to commit money laundering, which carries a maximum sentence of 20 years in prison. Morgan pleaded guilty to one count of money laundering conspiracy, a less serious money laundering offense with a five year maximum sentence, as well as one count of conspiracy to defraud the United States, which also has a five year maximum sentence.

Last week, prosecutors suggested that Morgan – who, according to court documents, did not know about her husband’s theft until 2020, when he enlisted her help to launder the coins – should serve only 18 months behind bars.

Prosecutors have asked the judge to go harder on Lichtenstein, however, who they argue spent months devising a scheme to gain access to Bitfinex’s systems and carry out his attack. They also point out that, while Lichtenstein has no official criminal history, he “experimented with other hacking and financial fraud activity” beginning as a juvenile. In 2016, before he hacked Bitfinex, Lichtenstein stole approximately $200,000 from another crypto exchange.

In their sentencing memo, prosecutors urged the judge to mete out a “strong sentence” for Lichtenstein in order to deter other “juveniles starting to head down a path similar to [Lichtenstein’s].”

“The criminal activity escalates, as they feel invincible and pursue new challenges. Anecdotally, self-medication and abuse of ADHD medication often appear to fuel the activity in many cyber crime cases the government has prosecuted. The difficulty faced by law enforcement in detecting and prosecuting lower-level cyber crimes often leads to a sense of impunity among perpetrators, leading – as here – to a pattern of increasingly serious and harmful criminal activity. A strong sentence in this case will help to break this cycle,” the filing said.

Prosecutors said that they believe Lichtenstein’s risk of recidivism is low, citing his age at the time of the crime and the fact that he was “abusing Adderall at the time of the offense, which may have contributed to the activity.”

“The government believes that the defendant will be able to use his considerable skill sets for legitimate ends, and hopes that he will make positive contributions to the cybersecurity and anti-money laundering industries following his sentence,” prosecutors wrote.

As part of his guilty plea, Lichtenstein already agreed to forfeit all the proceeds of his crime.

Lichtenstein is set to be sentenced on Nov. 14 at 2:00 p.m. in Washington, D.C. Morgan will be sentenced 24 hours later.