Nearly four months before Ilya “Dutch” Lichtenstein and Heather “Razzlekhan” Morgan were arrested for their role in the largest crypto heist in history, they were inadvertently tipped off that they were the targets of a criminal probe, leading the flamboyant pair to toss a computer down a garbage chute in a desperate bid to stymie investigators.
That’s according to plea documents unsealed Monday, which say an unnamed financial services provider told Lichtenstein in November 2021 that the feds had subpoenaed records for an account in his name. The company had been too slow in processing an extension of a non-disclosure order issued by a judge, and mistakenly sent out a notice informing the 35-year-old hacker of the government’s request.
“Upon receipt of the notice, Lichtenstein and Morgan took steps to further conceal their activities,” reads a statement of offense attached to Lichtenstein’s plea agreement. “For example, Lichtenstein deleted data from devices in the United States and abroad, and Lichtenstein and Morgan threw a computing device down a garbage chute, when said computing device contained relevant, inculpatory evidence related to this criminal scheme.”
ADVERTISEMENT
Lichtenstein and Morgan were arrested in February 2021 and pleaded guilty last Thursday to conspiracy to commit money laundering over the 2016 hack of Hong Kong-based cryptocurrency exchange Bitfinex. While Lichtenstein wasn’t charged with the $4.5 billion Bitcoin theft itself, his plea deal says he admitted to illegally penetrating Bitfinex’s servers and siphoning out the purloined funds. (Morgan’s plea docs had not yet been made public at the time of publication.) The government says it has managed to claw back most of the money.
The charge to which Lichtenstein confessed carries a maximum of 20 years in prison and a $500,000 fine. However, based on his criminal history and a number of other factors, including his acceptance of responsibility, prosecutors have recommended restitution to the tune of $72 million, plus a sentence of 10 to 12 years.
But while Lichtenstein didn’t have an existing rap sheet before now, the newly public statement of offense reveals he “engaged in earlier, less significant hacking and financial fraud activity, including as a juvenile.” In 2015, Lichtenstein “illicitly obtained and transferred a small amount of PayCoin, an alternative form of virtual currency,” it says. And, in addition to looting Bitfinex for billions, Lichtenstein used customer credentials stolen during the initial “reconnaissance phase” of the operation to vacuum up “an estimated several hundred thousand dollars’ worth of funds” from customer accounts at a second, unidentified crypto exchange.
Prosecutors have offered to sponsor Lichtenstein for a spot in the U.S. government’s Witness Security Program (WITSEC), colloquially known as the “witness protection program,” if he decides he wants to disappear for his own safety, according to the plea. This suggests Lichtenstein—whose plea deal in fact mandates his continued assistance, including “participating in covert law enforcement activities”—cooperated with the feds, and gave up others, according to former federal prosecutor Neama Rahmani.
It is unusual to see the Witness Security Program referred to in unsealed court documents, Rahmani told The Daily Beast, noting that any such negotiations are “supposed to be secret.”
If Lichtenstein does choose to take on a new identity, in a far-away place, his plea deal says he will be “governed exclusively” by the program’s rules. That means taking on a new identity, and a near-total break with his past, according to the U.S. Marshals Service, which administers the program and says it has never lost a protectee.
“The question about WITSEC is tethered to a question about cooperation,” Jarrett Wolf, a former prosecutor and DEA Special Agent now in private practice, told The Daily Beast. “$71 million is a lot of money. If I was investigating this case, I would be having a lot of conversations with Lichtenstein. A lot.”
Lichtenstein’s defense team did not respond on Monday to a request for comment and further details.
Lichtenstein formulated the Bitfinex heist carefully, coming up with a way to “reduce any perceived taint of the funds over time,” the statement of facts says.
It says Lichtenstein left the loot sitting dormant in a digital wallet for several months, then began moving the money out in countless small transactions, making it extremely difficult for law enforcement to trace. He then transferred some of the funds to darknet marketplaces like AlphaBay and Hydra, as well as exchanges that did not require “know-your-customer” protocols.
Morgan helped Lichtenstein launder the stolen funds but didn’t know until early 2020 that he was responsible for the hack itself, according to the statement of facts. She was an eager participant in cleaning the dirty money, prosecutors say, funneling it through banks in Russia, Ukraine, and the U.S. under fake names and false pretenses. They then traveled to various ATMs in multiple U.S. states to withdraw portions of the haul, using numerous cards but only one per ATM, “to avoid suspicion,” the statement of facts continues. Morgan also used some of the funds to buy gold coins, which she buried in an undisclosed location, the plea documents state, noting that investigators have since recovered the subterranean stash.
The two used a technique called “chain hopping,” which involves moving funds from one form of cryptocurrency to another in an effort to avoid being traced. It is a fairly “sophisticated” method of laundering money, and an important part of the so-called layering process, Wolf said.
In addition to gold coins, prosecutors said Lichtenstein and Morgan spent some of the stolen loot on NFTs, as well as “mundane things such as purchasing a Walmart gift card for $500.” Upon announcing their arrest last year, FBI Deputy Director Paul M. Abbate said, “Criminals always leave tracks, and today’s case is a reminder that the FBI has the tools to follow the digital trail, wherever it may lead.”
Tom Robinson, a cryptocurrency forensics specialist and the chief scientist and co-founder of Elliptic, a London-based firm that investigates crypto-based financial crime, told The Daily Beast at the time that he believed Lichtenstein and Morgan were likely identified via data seized in 2017 by federal law enforcement from darknet marketplace Alphabay. The initial complaint against the couple shows investigators tracing funds from Alphabay to a crypto account in Lichtenstein’s name. Far from being “anonymous,” Robinson said cryptocurrencies are in fact “highly traceable” by law enforcement.
Lichtenstein and Morgan captured the public’s attention after they were arrested and charged, though the two have certainly tried to garner strangers’ eyeballs for years. (The two were known to walk their cat on a leash near their apartment in Manhattan’s Financial District.) In 2019, Lichtenstein proposed marriage to Morgan via billboards he placed in Times Square, promoting her self-released hip-hop album. Morgan’s lyrics are the definition of cringe, with lyrics about “getting high in the cemetery.”
“Puff puff pass… Fuck the park / it’s full of fuck boy sex slaves,” she rhymes on one widely derided track. “I’m about to light it up / When a big ass horse pulls up / In a dark chocolate ‘67 Porsche / ‘How much for a hand job?’ / Yo, I’m not some kind of slutty basic ho / About to jack off a horse for a ride in yo po-shhhh.”
Court documents filed in court prior to the pair’s plea deals described an intricate investigation by agencies including the IRS, FBI, and the Department of Homeland Security. Prosecutors worried the two would flee, arguing for the two to be detained while the case worked its way to a conclusion. However, defense lawyers said the couple had every intention of sticking around, because they had “several” embryos in storage at a hospital in New York “in anticipation of starting a family together.”
A sentencing date has not yet been added to the court docket.
