2016 hack
In August 2016, Bitfinex announced it had suffered a major security breach.[12] Immediately thereafter, bitcoin's trading price plunged by 20%.[13] After learning of the breach, Bitfinex halted all bitcoin withdrawals and trading.[2] In that hack, the second-biggest breach of a bitcoin exchange platform, 119,756 units of bitcoin,[13] worth about $72 million at the time, were stolen. The bitcoin was taken from users' segregated wallets, while Bitfinex said it was tracking down the perpetrators of the hack.[14] Exchange customers, even those whose accounts were not broken into, had their account balance reduced by 36% and received BFX tokens in proportion to their losses.[15] All users who kept their BFX tokens were reimbursed in full within eight months of the hack in April 2017.[16] The exchange's access to U.S. dollar payments and withdrawals was then curtailed. The hack happened even though Bitfinex was securing the funds with BitGo, which uses multiple-signature security.[17]
The U.S. Department of Justice recovered the stolen bitcoin,[18] and a New York couple, Ilya Lichtenstein and his wife, Heather R. Morgan, was federally charged in February 2022 with conspiring to launder the bitcoin, which was then worth $3.6 billion.[19][20] According to Justice officials, Lichtenstein and Morgan are charged with conspiracy to launder money and conspiracy to defraud the United States.[20] On February 10, 2022, it was reported that Morgan was detained in Manhattan on February 8, 2022, with her husband.[21] According to court records, Lichtenstein and Morgan appeared for a plea hearing on August 3, 2023, in Washington, D.C.[22][23]
Since Lichtenstein and Morgan's arrests, the government seized another $475 million tied to the attack. In August 2023, Lichtenstein pleaded guilty to a conspiracy to launder stolen cryptocurrency in Washington, D.C. Morgan also pleaded guilty to two charges, money laundering conspiracy and conspiracy to defraud the U.S. government. The value of the stolen bitcoin ended up being worth $4.5 billion.[25][26][27] Lichtenstein also admitted to being the original hacker of bitcoin in the 2016 cyberattack on Bitfinex.[25] In November 2024, Lichtenstein was sentenced to five years in a U.S. prison for his involvement in money laundering the stolen bitcoin.[28] Morgan was sentenced to 18 months in prison for fraud and conspiracy charges.[29]
Referring to the 2016 hack, IRS Commissioner Charles Rettig said, "This was also the largest single financial seizure recorded by the federal government."[30] Separately, Bitfinex worked with the U.S. Department of Homeland Security to recover about $315,000 in cash and cryptocurrencies stolen in the 2016 breach. The funds would be redistributed to holders of Bitfinex's Recovery Right Tokens, digital coins issued to people who suffered financial losses due to the hack.[31] There was concern their customers' money had been lost in several incidents; the missing funds were not lost but seized and safeguarded. During this same period, Bitfinex found that obtaining banking services was more and more difficult.[32][33][34] Research suggests that price manipulation of bitcoin on Bitfinex accounted for about half of bitcoin's price increase in late 2017.[35] iFinex issued the cryptocurrency Unus Sed Leo in 2019. Once the United States announced that most of the stolen funds were recovered, Leo's value surged more than 50%.
