U.S. announced record $3.6 billion Bitcoin seizure tied to Bitfinex hack

The U.S. Justice Department announced on February 8, 2022 that federal authorities had arrested Ilya Lichtenstein and Heather Morgan in Manhattan and seized more than $3.6 billion in bitcoin connected to the August 2016 Bitfinex theft. The department described the recovery as its largest financial seizure at the time.

The announcement was significant beyond its headline value. It showed how investigators could combine the public Bitcoin transaction ledger with search warrants, exchange records and control of private keys to recover assets almost six years after an exchange breach. It also opened a potentially consequential recovery process for Bitfinex while underscoring that tracing bitcoin and taking custody of it were separate investigative steps.

The seizure preceded the announcement

Although the arrests and public disclosure occurred on February 8, the supporting affidavit established a more precise sequence. Investigators said they obtained a copy of a cloud-storage account under a 2021 search warrant. Much of its contents was encrypted.

According to the affidavit, law enforcement decrypted key files on or about January 31, 2022. One file allegedly contained approximately 2,000 Bitcoin addresses and their corresponding private keys. Investigators said blockchain analysis connected almost all of those addresses either directly to the Bitfinex theft or to unused addresses with zero balances.

Between January 31 and February 1, authorities obtained approval for a seizure supported by probable cause under exigent circumstances and used the keys to take control of approximately 94,636 BTC. The government requested a seizure warrant on February 2, and a court issued it on February 4. The affidavit, filed February 7 and unsealed with the case, said the bitcoin remained in government possession.

This chronology matters: February 8 was the date of the arrests and announcement, not the date on which the entire wallet transfer occurred.

Allegations traced a long laundering trail

The criminal complaint alleged that Lichtenstein and Morgan conspired to launder proceeds from 119,754 BTC removed from Bitfinex through more than 2,000 unauthorized transactions in 2016. Prosecutors alleged that approximately 25,000 BTC subsequently moved through a complicated series of transactions, while most of the stolen balance remained in the original receiving wallet.

The alleged laundering techniques included accounts created with fictitious identities, automated transfers divided into smaller amounts, movements through exchanges and darknet markets, conversion into other cryptocurrencies and the use of business accounts. Investigators said they combined public blockchain records with information obtained from financial institutions and virtual-currency exchanges to associate portions of the transaction trail with accounts controlled by the defendants.

The charges announced on February 8 were conspiracy to commit money laundering and conspiracy to defraud the United States. The complaint did not charge either defendant with executing the 2016 Bitfinex intrusion. Its assertions were allegations based on probable cause, and both defendants were entitled to the presumption of innocence.

Valuation required a defined window

The affidavit valued the original 119,754 BTC at approximately $71 million when the 2016 breach occurred and at more than $4.5 billion as of February 2022. It valued the approximately 94,636 BTC seized between January 31 and February 1 at $3.629 billion. The DOJ’s February 8 release rounded that recovered amount to more than $3.6 billion “at the time of seizure.”

Those figures were government valuations of BTC during the identified periods, not proceeds from a sale or an audited restitution amount. The records did not identify a particular exchange, composite index, observation timestamp or foreign-exchange methodology. Because bitcoin traded continuously across separate venues, the dollar figures should be read as contemporaneous estimates rather than exact closing values.

Bitfinex said it was cooperating with the Justice Department and would pursue the appropriate legal process to establish rights to the recovered bitcoin. No distribution order had been announced on February 8. The event-day conclusion was therefore limited but substantial: authorities had gained control of most of the stolen bitcoin by unit count, while ownership, restitution and the defendants’ guilt remained unresolved.