The hack of the crypto exchange Bitfinex has been described as the “heist of the century”; in total over 120,000 Bitcoin (US$4.5 billion at current prices) was stolen in a series of unauthorised transfers from Bitfinex users' wallets in August 2016.
Last week, the US Department of Justice made an apparent breakthrough in prosecuting this heist: over US$3.6 billion worth of the proceeds of the Bitfinex hack is claimed to have been traced to a New York-based couple, Heather Morgan and Ilya "Dutch" Lichtenstein, and was seized by the DoJ. Both Morgan and Lichtenstein have been arrested and charged with money laundering crimes; neither has yet entered a plea. They are not alleged to have been the perpetrators of the Bitfinex hack.
The case has generated headlines both because of the enormous value of the Bitcoin recovered and the idiosyncratic lifestyle of Morgan, who has produced a substantial catalogue of rap songs on TikTok and other platforms under the moniker “Razzlekhan”. In doing so, Morgan describes herself as “the crocodile of Wall Street” and “like Genghis Khan, but with more pizzazz”.
The case will also be of substantial interest to practitioners in the cryptoasset tracing and preservation community and to any litigants involved in crypto-based disputes, or whose opponents have cryptocurrency holdings amongst their assets. It shows the potential for advanced forensic blockchain tracing analytics to be used in unravelling very complex transfer sequences, and presents a novel example of how to ‘unlock’ the identities behind anonymous cryptocurrency wallets.
Tracing on the Blockchain
Whilst details of the DoJ’s investigation are still emerging, it is already clear that the DoJ was successful in an enormously complex ‘follow the money’ exercise, which involved transfers across multiple different cryptocurrencies and through ‘dark web’ institutions. It is also clear that, in doing so, the DoJ made use of specialist forensic blockchain experts.
Blockchain tracing is, at least from the perspective of the civil courts, a relatively novel area of expertise, but it is a substantial industry with sophisticated practitioners and its own established methodologies (or tracing ‘heuristics’). Experts in this discipline are able to utilise one of the inherent features of the Bitcoin blockchain (and many other cryptocurrency blockchains), which is that it is publicly available. The Bitcoin blockchain is a publicly searchable record of every Bitcoin transaction ever made.
With this access to every transaction, it is possible to apply specialist software to a known transfer (e.g. the transfers out of the Bitfinex wallets following the hack in 2016) and map out the subsequent transfers (including sub-divisions) of that Bitcoin. When faced with sophisticated fraudsters and/or money launderers, this tracing exercise is likely to encounter complex mechanics to obscure the ultimate destination of the transfers. That appears to have been the case with the Bitfinex hack, but the fact of the DoJ’s seizure indicates that the tracing methodologies are up to the task of penetrating those mechanics, even when they are carried out with a high degree of sophistication and complexity.
This inherent traceability of blockchain assets was something that the DoJ appears to have been keen to emphasise. In its press release following the Bitcoin seizure, the DoJ stated that “federal law enforcement demonstrates once again that we can follow money through the blockchain”. One source for a report on the seizure by the crypto exchange Coinbase put it much more bluntly, describing the hackers as “stealing a couple of billion in the world's most transparent and traceable assets."
Identifying blockchain users
Tracing on the blockchain only takes you so far.
It is another integral feature of the Bitcoin blockchain (and most other cryptocurrency blockchains) that it preserves user anonymity. Bitcoin users interact through numerical wallet IDs, meaning that even where payments can be traced to a given wallet, the difficulty remains of identifying the real person behind that wallet.
Details are still emerging for how the DoJ alleges the relevant wallets are connected to Morgan and Lichtenstein. But, at least part of that story appears to be more prosaic than might be expected: press reports suggest the DoJ was able to subpoena a cloud storage service in which Lichtenstein stored a single list of over 2,000 wallet IDs and the private keys to access these wallets. Private keys are essential to operating Bitcoin wallets – lose them, or forget them, and you are unable to access your wallet – and are long alpha-numeric chains, too complex to be committed to memory.
Accessing this type of personal record is a novel way of connecting wallets to an individual user. It also raises an interesting question for cryptoasset investigations generally, namely whether the inherent need that Bitcoin users face to keep a record of their private keys, and to keep that record somewhere safe, may cause third parties to have access to that information.
A case to watch
This is a case that we, at Hogan Lovells, will be following closely.
As the case progresses, we can expect more information to come out regarding exactly how the DoJ’s analysts were able to unravel the web of transfers and how the recipient wallets are alleged to be connected to Morgan and Lichtenstein. This information is likely to have knock-on effects for how litigants in civil proceedings conduct their own analyses, especially in cases where enforcement is attempted over cryptoassets or where such assets are the subject of a freezing order. This is already an area where our team are at the forefront: we are experienced in litigating Bitcoin and other cryptoasset issues in the English High Court and in working with cryptoasset tracing experts.
If you would be interested to hear more analysis of this case, or about our expertise more generally, please contact Richard Lewis or James Wise.
Authored by Richard Lewis and James Wise.
