A watershed in bitcoin crime with an unlikely couple in the glare

When anonymous hackers infiltrated cryptocurrency exchange Bitfinex in 2016, it shook the nascent world of digital currency and prompted speculation about who might have stolen what was then $71 million in Bitcoin.

But unlike traditional financial transactions, Bitcoin trades are publicly visible; moving the coins risked revealing who was behind the heist. And so for six years, as the value of Bitcoin soared, the loot sat in plain sight online as tiny fractions of the giant sum occasionally disappeared in a blizzard of complex transactions.

It was as if a robber’s getaway car was permanently parked outside the bank, locked tight, money still inside.

And then earlier this month, the car sped off.

In the strange and sometimes shadowy world of cryptocurrency, it was as if the earth shook. In the years since the Bitfinex hacking, crypto had exploded into the mainstream, and the theft had become notorious: a bounty worth more than $4 billion. At last, it seemed, the hackers had emerged from hiding.

But it was not the hackers who had moved the stolen Bitcoin. It was the government, which had seized it as part of an investigation into two New York City entrepreneurs: one a little-known Russian émigré and tech investor; the other, his wife, an American businesswoman and would-be social media influencer with an alter ego as a satirical rapper named Razzlekhan.

Charged with conspiring to launder billions of dollars in Bitcoin, the couple, Ilya Lichtenstein, 34, and Heather Morgan, 31, were accused of siphoning off chunks of the purloined currency and trying to hide it in a complex network of digital wallets and internet personas. If convicted of that and a second conspiracy count, they could face up to 25 years in prison.

The arrests shocked some acquaintances of the couple, whose goofy online lives appeared at odds with prosecutors’ description of them as sophisticated criminals with stacks of foreign currency, multiple fake identities and dozens of encrypted devices stashed in their New York apartment. As they awaited a Monday court hearing in Washington on whether they should be freed on bail, Lichtenstein and Morgan remained the subject of a confounding question: Could they really be at the center of one of cryptocurrency’s enduring mysteries?

The charges were a watershed in the evolving regulation of digital currency and, to some, a step forward in the government’s ability to trace its illegal laundering.

“The crypto space has always been seen as like a safe haven for criminals,” said Christopher Tarbell, a former FBI special agent who helped lead the investigation into the Silk Road online marketplace for illegal drugs and other illicit goods.

“We’re now seeing that law enforcement has the knowledge, tools and skills to provide some accountability in what was the new wild, Wild West of cybercrime,” Tarbell said.

Officials have not said whether they believe Lichtenstein and Morgan were directly involved in the Bitfinex breach. But their arrests laid bare the murky fringes of crypto culture, where the line between sophisticated virtual finance ventures and infantile online gags is razor thin and constantly shifting.

Sandra Ro, who leads the Global Blockchain Business Council, an industry association that advocates for the adoption of cryptocurrency markets, said the arrests “play into the narrative that the crypto community is populated by dubious and fringe characters, which is not the case.”

“There are adults in the room,” Ro said, “who are building real products and services to grow a multitrillion-dollar industry responsibly.”

For many who follow the industry, Lichtenstein and Morgan came off as familiar characters in a realm where fortune favored the boldest investors; the flashiest personalities got rich fast; and a single, obtuse tweet could rattle entire markets.

Almost immediately after the arrests, the hyperactive community that discusses cryptocurrency on social media and message boards began to pore over Morgan’s bizarre digital trail. Her videos — little-watched before she was charged — were suddenly being shared widely.

In one, apparently recorded at brunch, Morgan marvels at the size of her plate of pancakes, sneers, sticks out her tongue and wags her fingers before announcing that she is offering a commentary about consumerism and social media’s superficial nature.

The Bitfinex hacking was the stuff of legend, but Lichtenstein and Morgan hardly appeared to be suave or subtle digital cat burglars — or the tip of a grand conspiracy.

Sharing the pancake video, one typically irreverent Twitter account that comments on cutting-edge financial markets in an all-caps parody of the Incredible Hulk captured a widely expressed reaction to the revelation: “OK. THE HACKERS ARE NOT CIA. THEY ARE IDIOTS.”

Morgan was a regular contributor to Forbes and Inc., writing columns that advised her fellow entrepreneurs on how to protect their digital currency and recommending rapping as a form of self-care, as she did through her alter ego, Razzlekhan (Genghis Khan, but with more pizazz, her website says).

Those who know Morgan said her social media stunts were part of an elaborate act to confront social pressures.

“She works to free herself from a lot of the scripts that are embedded in our society,” said Morgan Brittni Sonnenfeld, who said she is Morgan’s cousin. “I admire her for that; she has a lot of strength.” Sonnenfeld acknowledged that news coverage of Morgan had made her “sound a bit crazy,” and she wondered whether Morgan’s persona may have drawn authorities to her.

“I wonder, why do they want people looking at her? Who are we not looking at? Why are they choosing this specific person?” Sonnenfeld said.

The arrests also surprised Morgan’s friends, who described her as a disarmingly honest colleague in an industry defined by cutthroat competition.

“It is very jarring to think someone so open and vulnerable with people would have secrets,” said one friend, Nora Poggi. “She is someone I care a lot about.”

In court records, the Justice Department describes the trail that it says led investigators to Lichtenstein and Morgan.

In January 2017, five months after hackers hit Bitfinex, a portion of what they stole was moved in small, complex transactions into accounts that the couple controlled, according to a criminal complaint filed in federal court in Washington.

“This shuffling, which created a voluminous number of transactions, appeared to be designed to conceal the path of the stolen” Bitcoin, the complaint says.

Lichtenstein and Morgan were budding tech entrepreneurs at the time. Lichtenstein specialized in cryptocurrency and coding, according to his LinkedIn profile, and Morgan had returned from the Middle East, where she focused on currency markets.

Anirudh Bansal, the couple’s lawyer, declined a request for comment. But in court papers, he has made it clear that he believes the government’s case is weak and relies on “unsupported, conclusory leaps.”

Beyond Morgan’s highly public persona, little is known about the couple. They have been together for seven years and married for three, Bansal told a federal magistrate judge in New York on Tuesday during arguments over whether the couple should be released on bail.

In saying that his clients were not a risk to flee, Bansal offered some personal details about them.

Lichtenstein, Bansal said, came to the United States from Russia when he was 6. His father works for the housing authority of Cook County, Illinois, and his mother is a biochemist at Northwestern University.

Morgan, who was born in Oregon, runs a consulting firm that employs up to 30 freelance writers at a time, Bansal said. Her father served in the U.S. military and is a retired biologist. Her mother is a high school librarian.

Lichtenstein’s family had immigrated to the United States to flee religious persecution, and there was “no chance” he would return to Russia, Bansal said.

In a later letter, another of the couple’s lawyers wrote that Morgan had frozen several of her embryos at a hospital in New York in anticipation of starting a family.

“The couple would never flee from the country at the risk of losing access to their ability to have children,” the lawyer wrote.

At the hearing, a prosecutor, Margaret Lynaugh, said in opposing bail for Lichtenstein, a dual citizen of the U.S. and Russia, that he had an active Russian passport and the means and intent to flee.

The judge ordered that the couple be freed on multimillion-dollar bonds, but at the government’s request, a federal judge in Washington blocked their release and scheduled the hearing Monday.

In court papers, the government has called Lichtenstein and Morgan “highly sophisticated criminals.” Prosecutors said they believed the couple had significant additional assets, including hundreds of millions of dollars in virtual currency stolen from the Bitfinex exchange that had not been recovered, as well as access to numerous fraudulent identities bought on the so-called darknet, a hidden portion of the internet used for illicit transactions.

The government says the couple had also established financial accounts in Russia and Ukraine and appeared to have been setting up a contingency plan for a life in one of those countries before the pandemic.

As evidence of what they depicted as a complicated money laundering scheme, prosecutors say in a court filing that they had traced stolen cryptocurrency to more than a dozen accounts held in the true names of the couple or their businesses.

The government says in the court filing that when agents executed a search warrant at the couple’s New York apartment Jan. 5, they recovered more than 50 electronic devices, including a bag labeled “burner phone,” and more than $40,000 in cash. Many of the devices were partially or fully encrypted or otherwise password-protected, the court filing says.

In Lichtenstein’s office, agents found two hollowed-out books whose pages appeared to have been cut out by hand to create secret compartments, the filing says. (The compartments were empty.)

And then there was the couple’s cat.

As agents were about to begin the search, Morgan and Lichtenstein said they would leave their apartment but wanted to take their cat, the filing says. The agents allowed Morgan to retrieve the cat, which was hiding under the bed.

But as Morgan crouched by the bed and called to the cat, she positioned herself next to a nightstand that held one of her cellphones, the filing says. She then reached up, grabbed the phone and repeatedly hit the lock button in what prosecutors say was an apparent effort to make it harder for investigators to search the phone’s contents.

The agents had to wrest the phone from Morgan’s hands. Court records provided no further information about the cat.

Check out the latest videos from DH: