Bitfinex Hacker Revealed: Razzlekhan's Husband Admits He Stole Billions in Bitcoin

Ilya Lichtenstein, who last month agreed to forfeit billions in a plea deal for his role in laundering funds from a 2016 hack of crypto exchange Bitfinex, has now admitted he was the hacker.

Although it has long been suspected either Lichtenstein or his wife, Heather Morgan, were the ones who stole 120,900 Bitcoin, it's only now been confirmed. The new detail was originally reported by CNBC on Thursday.

The couple appeared at a sentencing hearing today in Washington D.C. 

During the court hearing, the Bitfinex hacker also admitted that he and his wife converted some of the stolen crypto assets to gold coins and buried them. According to CNBC’s account of the hearing, Lichtenstein flew to Ukraine and Kazakhstan to convert the crypto to cash before depositing the funds in an American bank account.

Lichtenstein and Morgan (also known by her rapper name "Razzlekhan") were arrested early last year on charges of having laundered the funds stolen from Bitfinex in 2016. They could face up to 20 years in prison. 

As part of their plea deal, the couple has agreed to forfeit proceeds from the almost 120,000 Bitcoin they stand accused of laundering. At the time of their arrest, the Department of Justice seized $3.6 billion worth of Bitcoin it believed to be connected to the 2016 hack.

At the time, Deputy Attorney General Lisa O. Monaco said in a press release it was the department’s largest ever seizure of crypto assets and proved “cryptocurrency is not a safe haven for criminals.” 

Before the arrest, investors were keen to track the funds using blockchain data—a maddening bit of transparency for victims who can see their funds being moved around. A few weeks before the plea deal was announced in July, Bitfinex recovered a small portion of the Bitcoin Cash, about $314 thousand, that was taken during the 2016 hack. But the majority of the funds still have not been returned to users.

Editor's Note: This story was updated at 4 p.m. ET on Thursday, August 3 to add additional details about the hearing and context about the hack.