(Bloomberg) --One of the most enduring mysteries in the world of cryptocurrencies was resolved Thursday when Ilya Lichtenstein acknowledged that he was the hacker who executed the 2016 attack on the Bitfinex exchange.
Lichtenstein, along with his social-media rapper wife, who dubbed herself the "Crocodile of Wall Street," pleaded guilty to a money-laundering conspiracy tied to the theft of billions of dollars of Bitcoin from the exchange. Who executed the exploit has been the biggest guessing games in crypto after the identity of Bitcoin's pseudonymous creator, Satoshi Nakamoto.
Lichtenstein, 35, admitted during a hearing on Thursday before US District Judge Colleen Kollar-Kotelly that he orchestrated the hack, which took 119,756 Bitcoin from Bitfinex. He faces as long as 20 years in prison.
Lichtenstein and Heather Morgan entered their pleas as part of cooperation agreements with prosecutors. The government had charged them with conspiring to launder those stolen Bitcoin. The couple was arrested in February 2022 in New York, but they were not accused of doing the actual hacking at the time. A detailed report published along with the arrest showed how they were able to move the stolen funds after the hack.
Morgan, who also called herself "Razzlekhan, said her husband didn't make her aware of the hack until early 2020, initially thinking that his funds might have come from drugs or tax avoidance. Morgan, 33, developed a social media presence by rapping about investment strategies, calling herself a risk-loving moneymaker who was "sly as a gator."
The pleas come as part of a deal the couple struck with the government following several delays they requested since their arrest last year. As part of the arrangement, both agreed to forfeit almost $73 million combined. Morgan, who also pleaded guilty to conspiring to defraud the US government, could face a maximum of five years in prison for the two counts.
Bitfinex is the crypto exchange affiliated with the world's largest stablecoin, USDT. At the time of the hack, the value of the stolen funds was estimated at about $71 million.
Burying Gold Coins
During the hearing, the government outlined details of how Lichtenstein conducted the hack and later enlisted Morgan to help hide the source of the illicit funds. For example, Morgan admitted to burying gold coins that Lichtenstein had converted from stolen funds, setting up fictitious accounts and holding some of the illegal proceeds in her own legitimate accounts.
"I did help him launder funds at his direction," Morgan said.
Morgan also said her husband kept her in the dark about some of his activities, including subsequent hacks. "I was not aware of any of these other hacks until his arrest," she said. When the pair traveled to Kazakhstan and Ukraine, Morgan said she thought the purpose was for tourism. "I recall him burning documents at a trash can in Kazakhstan," she said, noting that he acted "evasive" when she questioned him.
Prosecutors alleged the two used fake identities to create online accounts and covered up the trail of transactions by depositing and withdrawing the stolen funds from virtual currency exchanges and darknet markets. Some of the money went to purchase nonfungible tokens, or NFTs, gold and Walmart gift cards, the government said.
When Bitfinex was hacked, Bitcoin was trading under $1,000. It had skyrocketed to $44,000 by the time the couple was arrested in early 2022, pushing up the value of the stolen assets to $4.5 billion, of which $3.6 billion was recovered by authorities. Since then, the cryptocurrency has fallen to around $29,000.
--With assistance from Muyao Shen.
