US prosecutors call for reduced five-year prison sentence for 2016 Bitfinex hacker Ilya Lichtenstein

U.S. prosecutors called for Ilya Lichtenstein to serve a 60-month (five-year) prison sentence, followed by three years of supervised release​ over money laundering charges related to the 2016 hack against crypto exchange Bitfinex.

Despite engaging in prior cyber criminal activities before the Bitfinex hack, the U.S. government is seeking a lower sentencing than the advisory guidelines of 121-151 months due to the defendant’s cooperation in the case, as well as assistance in other investigations beyond his own, according to a sentencing memorandum filed with the United States District Court for the District of Columbia on Tuesday. For example, Lichtenstein testified against the operator of the crypto mixer Bitcoin Fog during a trial earlier this year.

However, Lichtenstein would still serve significantly more time behind bars than his wife and co-conspirator, Heather Morgan, as he was primarily responsible for the Bitfinex hack, according to the filing. Last week, prosecutors recommended an 18-month sentence for Morgan, a rapper also known as “Razzlekhan,” given her lesser role in helping Lichtenstein to launder the funds after she found out he was behind the attack.

Regardless, prosecutors said a strong sentence for Lichtenstein would help “break the cycle” of young cybercriminal defendants who develop impressive technical expertise from an early age but feel socially isolated and seek out community online. “They are exposed to criminal activity in those online spaces, and the activity is normalized in a way that trivializes the impact on the victims,” prosecutors told a federal judge.

Bitfinex the sole remaining victim of the 2016 hack

Lichtenstein and Morgan pleaded guilty in August 2023 to money laundering conspiracy charges in connection with the 2016 Bitfinex security breach. The two allegedly conspired to launder 119,754 BTC in August 2016, which at the time was valued at around $70 million, according to the government, and would now be worth around $8 billion.

The pair were arrested in 2022 and charged with conspiracy to commit money laundering and conspiracy to defraud the U.S. When the stolen funds were recovered, it represented the U.S. Justice Departments largest ever financial seizure.

According to Tuesday’s filing, a forfeiture money judgment of $72.6 million was agreed upon, but the value of the seized assets is expected to exceed this amount. Lichtenstein agreed to forfeit significant assets linked to the hack, including around 94,643 BTC and additional cryptocurrencies like Bitcoin Cash, BSV and Bitcoin Gold, among other assets, collectively valued at more than $6 billion at current prices — as in-kind restitution to Bitfinex. Morgan is also to be held jointly liable for any restitution ordered.

Last week, the U.S. government said Bitfinex might be the sole remaining victim of the 2016 hack involving the defendants.

Following a restructuring of Bitfinex’s operation amid solvency issues after the hack, parent company iFinex said customers were able to sell BFX tokens issued by the crypto exchange on the market or back to the platform for cash or iFinex stock, among other options.

"All customers holding BFX tokens chose to exercise one of those options, and as of April 3, 2017, all BFX tokens were fully redeemed," the firm said.

However, "out of an abundance of caution," the government asked the court to allow Bitfinex account holders a chance to submit claims ahead of sentencing.

Lichtenstein’s sentencing is scheduled for Nov. 14, and Morgan’s the day after.