Bitfinex Hack
What happened
Bitfinex lost 119,754 BTC in August 2016 through more than 2,000 fraudulent transfers. U.S. prosecutors later identified Ilya Lichtenstein as the hacker.
He pleaded guilty to money-laundering conspiracy in 2023 and received a five-year prison sentence in November 2024.
The Justice Department describes unauthorized network access and fraudulent transaction authorization, but its public account does not specify the initial software vulnerability or credential-compromise method.
Case & protocol details
How it happened
- Lichtenstein entered Bitfinex's network and fraudulently authorized transfers to a wallet he controlled, according to the Justice Department.
- He deleted access credentials and logs to conceal the intrusion.
- He later enlisted Heather Morgan to help launder the stolen funds through exchanges, mixers and other channels.
- The subsequent criminal proceedings established guilty pleas for money-laundering conspiracy.
Funds Recovery
Recovered
$65.0M
Net Loss
$6,984,000
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report archive.is
- analysis 2016 Bitfinex Hack justice.gov
- analysis Security Breach blog.bitfinex.com
- analysis DOJ: Bitfinex hacker sentencing and admitted conduct justice.gov
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
