Blog Article 

 A $5 Billion Case Study In Crypto Fraud & Laundering Part 1 

Picture of Michael Santos

Michael Santos

Need Answers to Your Questions?

Free Copy of Earning Freedom


The recent arrest of a young married couple in New York over $5 Billion in stolen crypto and attempted laundering is another opportunity to expand our understanding of federal crimes in the crypto space.

This case specifically includes charges of conspiracy to defraud the United States and to commit money laundering.


For six years, the crypto world had its eyes trained on the 2016 hack of about 120,000 bitcoin stolen from one of the biggest virtual currency exchanges in the world, Bitfinex. 

Their value at the time was over $70 million. 

Their value today is close to $5 Billion.

For a while, people believed that the 2016 hack must have been the work of a well-oiled criminal organization. As the hackers remained underground, the legend grew that it was the work of a professional criminal organization.

Is It Easy to Launder Crypto?

To enjoy the proceeds of the heist, the hackers would have to launder the stolen bitcoin in massive quantities. But, how hard could it be? Shouldn’t it be easy to launder crypto? Isn’t the ease of use and anonymity part of what makes virtual currency so attractive?

After a six-year chase and global investigation, a young married couple is under arrest. 

In the end, they were unable to launder or use the vast majority of the stolen bitcoin. The federal government has seized about $3.6 Billion worth of the original coins linked to the hack, which they found sitting on the blockchain after all these years.

Actually, it looks as if the couple never even tried to launder most of the stolen coins—94,636 bitcoin, or about eighty percent of the total, never left the original wallet. 

The reason? Laundering digital currency might be more challenging than people imagine, and it is more challenging the higher the amounts.

The money laundering techniques the couple used, according to the government? Peel chains, mixing and tumbling, chain hopping, and layering.

As detailed below,  chain hopping (moving quickly to and from multiple cryptocurrencies), “Bitcoin mixing” (mixing up illegal funds with the legitimate coins of other users), and others are tools crypto launderers use to obscure the movement of illegal funds and complicate law enforcement investigations.

The Charges

On February 8, 2022, the Department of Justice announced the arrests of Ilya Lichtenstein and Heather Morgan in New York. 

They face charges of conspiring to launder $4.5 billion of stolen Bitcoin and conspiracy to defraud the United States. The government recovered approximately $3.6 Billion of the stolen Bitcoin, their largest crypto seizure in history.

How did Morgan and Liechtenstein conspire to defraud the United States? 

Let’s look at the basics of federal conspiracy charges and what it means to defraud the United States in their case.

How Do Federal Prosecutors Define “Conspiracy?”

The federal government defines a criminal conspiracy very broadly. Conspiracy simply means that in the prosecutor’s eyes, a person agreed with another person to commit a criminal act. Federal prosecutors routinely include conspiracy charges under 18 USC §371 to cover a wide range of conduct.

A “conspiracy” to commit a federal crime occurs whenever:

  • two or more people agree to commit a specific federal crime, and
  • at least one of them takes some overt act to further the conspiracy.

Federal prosecutors do not have to show a written agreement between two or more people in conspiracy cases. All they have to show to sustain a conspiracy charge is some evidence that the alleged co-conspirators were working together to complete a federal crime.

The bar is very low.

People that get caught up in federal conspiracy cases often struggle to understand how something they considered innocuous comes back to haunt them. The truth is that federal prosecutors don’t need much to bring someone into a criminal conspiracy. 

Indeed, criminal conspiracy statutes condemn the very act of agreeing to pursue a goal that the law considers wrong; the agreement itself is criminal, whether the conspiracy accomplishes its goal or not.

Common Federal Conspiracy Charges

18 USC § 371 allows prosecutors to add a conspiracy charge to just about any federal crime. Some of the most common instances in which federal prosecutors include conspiracy are:

  • Securities fraud
  • Racketeering
  • Healthcare fraud
  • Drug trafficking and related offenses
  • Mail fraud and Wire fraud
  • Money Laundering
  • Embezzlement
  • Counterfeiting
  • Bank fraud
  • White-collar crime

The federal conspiracy statute, 18 USC § 371, criminalizes both conspiracies to defraud the United States and conspiracy to violate any other federal laws.

Liechtenstein and Morgan face charges of conspiracy to defraud the US under 18 USC § 371.

What is a Conspiracy to Defraud the United States?

To conspire to defraud the United States means primarily:

  • to cheat the federal government out of property or money, or 
  • to interfere with or obstruct one of its lawful governmental functions by deceit, craft, trickery, or dishonesty.

Under this statute, a person can “defraud” the United States by, for example:

  • Obstructing or impairing the efficiency of any department of the government, to destroy its operation and reports as fair, impartial, and reasonably accurate; and
  • Cheating the government out of money or property

Some common examples of defrauding the US government include engaging in dishonest practices concerning various government programs administered by federal agencies.

What is the Sentence For Conspiracy to Defraud the United States?

18 US Code Section 371, the federal conspiracy statute, penalizes a conspiracy to defraud the US by up to five years imprisonment, plus fines.

Pro-Tip: Section 371 of 18 US Code states: If two or more persons conspire either to commit any offense against the United States or to defraud the United States, or any agency thereof in any manner or for any purpose, and one or more of such persons do any act to effect the object of the conspiracy, each shall be fined under this title or imprisoned not more than five years, or both.

What is Sentence for Attempting to Launder $4.6 Billion in Crypto?

Lichtenstein and Morgan face conspiracy to commit money laundering, which carries up to 20 years in prison, and conspiracy to defraud the US, which carries up to 5 years in prison. A federal judge determines sentencing after conviction based on the sentencing guidelines and other factors.

Crypto Money Laundering Techniques

We have covered a few commonly used laundering techniques in our crypto laundering series. See below:

Building on that, these are the cryptocurrency laundering techniques Morgan and Lichenstein used attempting to launder billions of dollars worth of Bitcoin. 

It looks like Morgan and Lichenstein understood some complicated aspects of crypto laundering, using techniques like peel chain, chain hopping, mixing and tumbling, and layering

How were they able to implement these techniques? 

Let’s walk through it.

The defendants stole about 120,000 bitcoins in late 2016. In early 2017, through a high volume of small transactions flowing into multiple accounts on multiple platforms, they moved a portion of the stolen bitcoin out of the original wallet. This step attempts to conceal the movement of large amounts of the stolen bitcoin. 

  • Peel chain:
    • The government’s affidavit in support of the criminal charges summarizes the defendants’ use of peel chain as follows:
      • The couple moved some of the bitcoin out of the original wallet using “a series of small, complex transactions across multiple accounts and platforms” (thereby mixing, tumbling, and chain hopping (see below).
      • All of this shuffling created thousands of transactions designed to conceal the path of the stolen Bitcoin, making it difficult for law enforcement to trace the funds. These minute successive and randomized transfers are sometimes known as a peel chain. A diagram of peel chain might look like an airline route map with several multiple lines sprouting from one dot and converging on another.
      • More specifically, the peel chain in cryptocurrency is when a series of rapid transactions are initiated. A small amount gets peeled off in each successive transaction and goes into other accounts in other exchanges. 
      • These tiny slivers taken off a lengthy chain of transactions are less likely to trigger any anti-money laundering red flags. A crypto launderer can programmatically create a large number of transactions like this to occur in a short timeframe to make these tiny slivers add up to move large amounts overall.
  • Chain hopping:
    • Chain hopping is a layering technique and simply refers to0 converting one form of cryptocurrency into another and moving your funds from one blockchain to another.
    • With chain hopping, one type of coin gets swapped for another—say Bitcoin to Sol or Monero—to disguise the provenance. The use of chain hopping is prevalent and growing among criminal actors, who prefer to use companies that are not using any know-your-customer procedures.
  • Mixing & Tumbling:
    • Tumbling or mixing takes a bunch of transactions all happening simultaneously and breaks the links of coins in each transaction by swapping them with other transactions happening simultaneously. The specific goal of this feature is to make transactions harder to trace back to specific owners and accounts.
    • In the case of Lichenstein and Morgan, they laundered some of the original Bitcoin through an exchange called Alpha Bay. In the summer of 2017, when law enforcement raided Alpha Bay and took down the site, they seized one of Alpha Bay’s servers. The server may have helped law enforcement re-link all the accounts and Bitcoin that Morgan and Lichenstein had tumbled through Alpha Bay.
    • Mixers are companies offering cryptocurrency commingling services for a fee to help people conceal or disguise the source or owner of particular cryptocurrency units. To federal law enforcement, crypto mixing companies pose a high risk of facilitating criminal activity, including money laundering. 
  • Layering:
    • The layering process involves introducing more and more layers between the initial source of legal activity and where the funds ultimately end up.
    • By moving to another account, people can add a layer. Moving the coins from that new account into multiple other accounts allows people to introduce more layers. In the case of Morgan and Lichenstein, some of the stolen Bitcoin got transferred out of the original wallet, and then each move of the coins added a layer. 
    • People can also convert one form of bitcoin to another, as in from bitcoin to other cryptocurrencies, and so on. The more layers, the harder it gets to trace funds.

Can Law Enforcement Tie Defendants to Stolen Bitcoin?

Many people attracted to cryptocurrency like bitcoin believe it is anonymous and untraceable. 

However, Bitcoin and other cryptocurrencies are traceable. 

In fact, the permanence or immutability of the Bitcoin blockchain means that people’s fingerprints for any transactions, illegal or otherwise, are recorded in a public ledger and widely available forever. 

And while money laundering techniques can make cryptocurrencies harder to trace, they are not untraceable. 

As Ed Caesar of The New Yorker aptly observed:

Launderers must also contend with the fact that coins are traceable. The ledger on which trades occur is immutable. It should always be possible to track stolen loot through its digital footprint. The problem of handling stolen bitcoin is not unlike that of smuggling a Picasso in the trunk of your car. Everybody knows it’s a Picasso because it looks like a Picasso and it’s got Picasso’s signature on it. Stealing the painting is one thing; realizing any monetary gain for it is another.

Know Your Customer (KYC)

One of the challenges Morgan and Lichenstein encountered was that a virtual currency exchange would occasionally request by email additional KYC documents under anti-money laundering Know Your Customer rules.

When the defendants failed to provide any documents to verify the names used to open the accounts, the exchange froze the accounts. This is what ought to happen when a virtual currency exchange implements anti-money laundering protocols.

Therefore, as digital currency creates opportunities for criminality, it also presents obstacles. 

The desired outcome of most crypto hacks is to convert stolen crypto into traditional currency—dollars. That’s going to be hard if virtual currency exchanges have basic know-your-customer or other anti-money-laundering protocols in place. An exchange risks the wrath of federal law enforcement if large amounts of Bitcoin arrive, and the anti-money laundering team fails to ask some follow-up questions.

The Government’s Largest Seizure of Bitcoin in History

The vast majority of the stolen Bitcoin is now in the hands of the federal government, having never left the original wallet until January 31st of this year when authorities accessed the wallet.

How was law enforcement finally able to access the wallet? 

They decrypted a file in one of the defendant’s cloud storage accounts that contained a list of 2000 virtual currency addresses and their private keys. 

Of the 120,000 coins initially stolen in the 2016 hack, the government seized 94,636 bitcoin worth $3.6 Billion. 

We will learn more about law enforcement’s evidence in the case as the criminal case develops. So far, it looks like there may have been two key events that helped to unravel this conspiracy to launder money: 

One hiccup was Lichtenstein keeping a copy of all his passwords to thousands of crypto addresses – including notes on which accounts were frozen due to suspicion of money laundering – in a cloud storage account that investigators seized with a warrant. 

The second hiccup was the seizure of the Alpha Bay server that may have contained the keys to re-linking all the commingled crypto transactions Alpha Bay mixed and tumbled for its clients.

One final question, for now, is this: why was so much of the stolen stash sitting in the original wallet in the end?

Because the sums Morgan and Lichtenstein needed to launder were too massive. Unless they could launder, they really did not have billions in Bitcoin. They just had a bunch of worthless digital currency. 

Their accounts were frozen each time they attempted to open new accounts on an exchange using fake identities, and the exchange could not verify the accounts. As such, they kept running into closed doors. 


The case of Morgan and Lichenstein exemplifies the dogged determination of federal law enforcement to resolve the 2016 Bitcoin hack. Federal law enforcement continues to show us that its ability to track down criminal activity in the crypto space is only getting better.

Prison Professors, an Earning Freedom company, works alongside (not in place of) civil and criminal defense counsel to help clients proactively navigate through investigations and prosecutions. Our team also helps clients prepare mitigation and compliance strategies.

If you have any questions or are uncertain about any of the issues discussed in this post, schedule a call with our risk mitigation team to receive additional guidance.

Need Answers to Your Questions?

Leave a Comment

Your email address will not be published. Required fields are marked *

We Have Updated Our Terms And Conditions

We have updated our Privacy Policy, Terms of Use, and Terms of Service page. To review the latest version, please click on Terms of Use. If at any time you choose not to accept these terms, please do not use this site.