It was a Bitcoin hack so big and complex that the laptop used to trace and recover the stolen coins will soon be on display at the Smithsonian. There was a recovery effort so grand it yielded 80% of the stolen Bitcoin and the largest forfeiture in the history of the Department of Justice.
The crypto exchange at issue is one of the world's largest, Bitfinex. And now, with Bitcoin prices surging, its customers unexpectedly may have an opportunity to receive restitution in the coming months, as the hackers are sentenced to prison. The fight over who is entitled to share in the billions worth of recovered assets is about to get underway, and the outcome of that fight is sure to have far reaching consequences for the crypto industry and future victims of cybercrimes.
The 2016 hack
As court records detail it, in 2016, Ilya "Dutch" Lichtenstein breached Bitfinex's security system and stole 119,754 bitcoins (BTC) from the exchange's customers. The stolen Bitcoin, then valued at $71MM, today exceeds $12 billion. Although the identity of the hacker was unknown until recently, the public Bitcoin ledger revealed that the stolen coins were transferred to a digital wallet known as "Wallet 1CGA4."
Following the theft, Bitfinex suspended trading, Bitcoin's price dropped 20%, and Bitfinex decided to "generalize" losses across all accounts and assets. All Bitfinex customers (even those not impacted by the hacking) found their holdings decreased by 36.06%. In place of their missing holdings, customers received BFX tokens (and in certain cases, Right to Recovery Tokens (RRT)), which have not garnered the same returns as the lost cryptocurrency.
Over the next few years, Lichtenstein and his wife, Heather "Razzklekhan" Morgan, an entrepreneur, Forbes contributor and "surrealist" YouTube rapper, committed a complex scheme to launder the stolen Bitcoin. They started out small, converting small amounts of Bitcoin into fiat currency, physical gold, and a Walmart gift card (used supposedly to purchase a Sony PlayStation). Starting in 2019, the couple grew bolder and laundered tens of millions of dollars in Bitcoin (and attempted to set up false identities and bank accounts in Ukraine and Russia).
The discovery and the recovery
In 2021, the DOJ obtained search warrants for the couple's Manhattan home and cloud storage accounts, which authorities discovered contained information related to thousands of crypto wallets. After decrypting the files, and performing a tracing analysis, the DOJ linked those wallets directly to the Bitfinex hack.
The fight over who is entitled to share in the billions worth of recovered assets is about to get underway, and the outcome of that fight is sure to have far reaching consequences for the crypto industry and future victims of cybercrimes.
In February 2022, Lichtenstein and Morgan were apprehended and charged with money laundering and conspiracy (but not with the original 2016 hack, for which the statute of limitations had expired).
Both defendants pleaded guilty (Lichtenstein admitted to the 2016 hack) and cooperated with the DOJ to help recover approximately 94,000 BTC (worth $3.6 billion in 2022). The DOJ's recovery was the largest seizure of assets in its history, with a current value of over $9 billion. In November 2024, Lichtenstein was sentenced to five years in prison, and Morgan was sentenced to 18 months.
The restitution race
As to who will receive the $9 billion in recovered Bitcoin, a restitution hearing is scheduled for Feb. 25, 2025. In a recent filing, the DOJ stated, "it does not believe Bitfinex or former accountholders of Bitfinex qualify as 'victims'" under the Crime Victims' Rights Act or the Mandatory Victims Restitution Act. Nevertheless, at the same time, "out of an abundance of caution," the DOJ set up a website to collect statements from persons impacted by the 2016 hack.
Bitfinex believes it is the "sole victim" and has submitted a victim statement, supported by its parent, iFinex. The DOJ will outline its ultimate position as to which persons are victims and entitled to restitution in its "Supplemental Restitution Memo" due on Jan. 14, 2025. Third parties, including Bitfinex customers, will have the ability to file an objection to the DOJ's position by Jan. 28, 2025, and argue why they are the true victims. The authors are advising parties with an interest in the outcome of the valuation and restitution issues described in this article.
Victim analysis factors
Restitution of recovered property is generally reserved for victims of the crimes in question. Under the Mandatory Victims Restitution Act (MVRA), a "victim" means "any person directly harmed by the defendant's criminal conduct in the course of [a] scheme, conspiracy, or pattern." 18 U.S.C. § 3663A(a)(2). The Crime Victims' Rights Act (CVRA) defines a "crime victim" in relevant part as "a person directly and proximately harmed as a result of the commission of a Federal offense." 18 U.S.C. § 3771(e)(2)(A).
The DOJ will outline its ultimate position as to which persons are victims and entitled to restitution in its "Supplemental Restitution Memo" due on Jan. 14, 2025.
Several factors may come into play in the Court's analysis here as to which parties are victims under the MVRA and CVRA.
To start, the Court may focus on when the underlying money laundering and conspiracy crimes occurred. The DOJ has suggested that customers may have been victims of the 2016 hack, but the DOJ was barred from charging the defendants for crimes related to the hack due to the expired limitations period. Some customers have pointed out, however, that defendants laid the groundwork for the money laundering scheme well before the hack, meaning they were also victims of the money laundering, for which the defendants were charged.
Another factor is the harm incurred by the victims. iFinex argues, among other things, that it suffered the harm directly because the defendants stole the Bitcoin from Bitfinex wallets. Yet, the assets in those wallets belonged to Bitfinex's customers, as stated in Bitfinex's express terms of service.
The Court may also analyze whether Bitfinex made its customers whole by awarding them BFX and RRT tokens. As noted, those tokens have not returned anywhere near the value of the stolen Bitcoin and other cryptocurrencies. Customers lost the opportunity to hold the stolen Bitcoin during the period in which its price soared from approximately $600 in 2016 to more than $100,000 at the time of this writing.
Price volatility has shaped other disputes
Wild cryptocurrency price appreciation has also shaped a myriad of other legal disputes, raising the stakes for crypto investors that maintain their holdings on an exchange. For example, disputes have arisen in bankruptcy as to how cryptocurrency should be valued for purposes of both customer claims and clawback claims.
In the FTX bankruptcy, the court approved distributing hundreds of millions in assets forfeited by Sam Bankman-Fried to certain shareholders, even though customers there will not be paid back based on current cryptocurrency prices.
Conclusion
The Court's decision on who is entitled to restitution is bound to ripple through the crypto markets. If Bitfinex obtains restitution of the more than $9 billion in stolen Bitcoins for itself, it would arguably receive a windfall beyond the intentions of the MVRA and CVRA. A decision in Bitfinex's favor would also have customers thinking twice about where they decide to store their digital assets, and whether to accept substitute tokens when (and not if) the next hack occurs.
Originally published by Reuters Legal News and Westlaw Today on December 9, 2024
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
