On August 04, 2023, a married couple from New York City pleaded guilty to money laundering charges in connection with the 2016 hack of cryptocurrency stock exchange Bitfinex. The crime resulted in the theft of about 120,000 bitcoin, valued at $3.6 billion at the time. Since then, the U.S. government has seized another $475 million tied to the breach.

Ilya Lichtenstein, 35, and his wife, Heather Morgan, 33, were arrested in February 2022, and the U.S. Department of Justice (DoJ) alleged that Lichtenstein used advanced hacking tools and techniques to access Bitfinex’s network. Then, he fraudulently authorized more than 2,000 transactions in which 119,754 bitcoin was transferred from Bitfinex to a cryptocurrency wallet in his control.

Morgan was also involved in the crime, launder the crypto proceeds using methods as diverse as setting up online accounts via fake identities, exchanging a chunk of the bitcoin into gold coins and other crypto assets, and covering up the trail by sending the funds through mixing services. It was found that a large portion of the illegal money was moved to the now-defunct darknet market AlphaBay, which was used as a mixer by depositing the stolen Bitcoin and withdrawing equivalent amounts.

The cryptocurrency was then sent to other mixers and virtual currency exchanges (VCEs). In 2020 and 2021, a part of the digital assets were converted to fiat currency and moved to a U.S. bank account. The pair also purchased gift cards for Walmart and other businesses at another VCE, using the bitcoin that was moved to the exchange previously. This provided crucial clues in the investigation.

The Walmart gift card was redeemed through the retail giant’s iPhone app under an account in Morgan’s name, which enabled authorities to get a search warrant for the couple’s home and their cloud storage accounts. The latter was a major break as it led to the discovery of files containing details of the cryptocurrency addresses used to move the stolen funds, including their private keys, along with the fraudulent information used to open accounts at various crypto exchanges and their plans to acquire fake passports.

Lichtenstein, a Russian national, faces a maximum penalty of 20 years in prison, while Morgan, who pleaded guilty to one count of money laundering conspiracy and one count of conspiracy to defraud the U.S., awaits a maximum jail term of 10 years.