Bitfinex, one of the world’s largest cryptocurrency exchanges and a major holder of Bitcoin (BTC), has achieved a significant legal victory, as the US District Court for the District of Columbia has ruled that Bitfinex is the sole entity eligible for restitution related to the nearly 120,000 BTC stolen in a high-profile hack back in 2016.
Charges Filed Against Bitfinex Hackers
The perpetrators of this hack, Ilya Lichtenstein and Heather Rhiannon Morgan, were charged with multiple offenses, including money laundering conspiracy and conspiracy to defraud the United States for their involvement in the theft of 119,754 BTC from Bitfinex’s exchange in August 2016.
On August 3, 2023, Lichtenstein pled guilty to one count of money laundering conspiracy, while Morgan pled guilty to two counts: one for money laundering conspiracy and another for conspiracy to defraud the United States.
According to the court filing, Lichtenstein orchestrated a complex scheme to defraud Bitfinex. He allegedly conducted an extensive online survey of the exchange’s computer infrastructure and gained unauthorized access to its servers.
Lichtenstein obtained the private keys to authorize transactions involving Bitfinex’s virtual currencies by exploiting vulnerabilities. In August 2016, he used these keys to execute over 2,000 transactions, transferring approximately 119,754 BTC to a wallet under his control, valued at around $71 million.
During his survey, Lichtenstein also compromised customer login credentials from Bitfinex. He employed these credentials in a technique known as “credential spraying,” attempting to access user accounts across various platforms.
Court Ruling Opens Door For Hack Victims To Assert Claims
In the wake of this ruling, the US government has recognized that while Bitfinex is the primary victim, “numerous individuals and groups” may also be affected.
However, the government lacks complete information on the identities of all affected account holders. To address this, they plan to utilize the Department of Justice’s (DOJ) website for “large cases” to establish a case-specific site.
This will allow potential victims to access required notices and provide a means to submit claims regarding their losses.
The government asserts that while it does not consider these individual account holders as “victims” under current legal definitions, it seeks to grant them the opportunity to assert their claims through alternative notification methods.
The filing also revealed the sentencing dates for Lichtenstein and Morgan, which are scheduled for 14 and 15 November 2024 respectively.
At the time of writing, the largest cryptocurrency on the market, BTC, was trading at $61,790, recording losses of 1% and 3% over the 24-hour and 14-day periods, respectively.
Featured image from DALL-E, chart from TradingView.com