What happened
Bitfinex lost 119,754 BTC in August 2016 through more than 2,000 fraudulent transfers. U.S. prosecutors later identified Ilya Lichtenstein as the hacker. He pleaded guilty to money-laundering conspiracy in 2023 and received a five-year prison sentence in November 2024.
The Justice Department describes unauthorized network access and fraudulent transaction authorization, but its public account does not specify the initial software vulnerability or credential-compromise method.
How it happened
- Lichtenstein entered Bitfinex's network and fraudulently authorized transfers to a wallet he controlled, according to the Justice Department.
- He deleted access credentials and logs to conceal the intrusion.
- He later enlisted Heather Morgan to help launder the stolen funds through exchanges, mixers and other channels.
- The subsequent criminal proceedings established guilty pleas for money-laundering conspiracy.
Protocol details
Funds Recovery
Recovered
$65.0M
Net Loss
$6,984,000
Evidence
- report Report archive.is
- analysis DeFiLlama defillama.com
- analysis 2016 Bitfinex Hack justice.gov
- analysis Security Breach blog.bitfinex.com
- analysis DOJ: Bitfinex hacker sentencing and admitted conduct justice.gov
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
