Bitfinex Hack Case Study: How Investigators Traced 120,000 Stolen Bitcoin - CyberSecurityNews

In 2016, hackers stole 119,754 bitcoin worth approximately $71 million from cryptocurrency exchange Bitfinex. The attacker, Ilya Lichtenstein, used advanced hacking tools to authorize over 2,000 fraudulent transactions before deleting access credentials and log files to cover his tracks.

Most of the stolen cryptocurrency remained in the original wallet for years, with only about 25,000 BTC being moved out over roughly five years. The laundering techniques employed by the hackers included opening accounts under fictitious identities, automating transactions, and converting bitcoin into other cryptocurrencies including privacy coins like Monero.

Laundering Techniques

The stolen funds passed through unhosted addresses to the AlphaBay darknet market before being processed through peel chains, coinjoins, and conversions to privacy-enhanced coins. Lichtenstein testified to using Bitcoin Fog and other mixers like Helix to obscure the transaction trail.

Investigative Methods

The investigation combined blockchain forensics with traditional legal processes. The IRS Criminal Investigation's Cyber Crimes Unit, FBI, and Homeland Security Investigations led the case with assistance from German police. Investigators anchored on the theft wallet, clustered addresses using common-input ownership heuristics, and followed peel chains to regulated services.

The breakthrough came when investigators accessed files in an online account controlled by Lichtenstein that contained the private keys to the theft wallet, enabling the seizure of more than 94,000 BTC worth over $3.6 billion at the time.

Case Outcomes

The recovery represented the largest financial seizure in US Department of Justice history. Lichtenstein received five years plus three years of supervised release, while Morgan received 18 months. In January 2025, a court ruled that 94,643 BTC would be returned to Bitfinex under a restitution agreement.

The case highlights security vulnerabilities in cryptocurrency exchanges. Experts recommend implementing withdrawal velocity limits, multi-party authorization for large withdrawals, and immutable logging to prevent similar breaches. The investigation also underscores the importance of retaining KYC, IP, and device records for extended periods.