The 2016 Bitfinex hack: 120,000 stolen bitcoin, a haircut for customers, and a record seizure

One day in August 2016, the coins walked out

On 2 August 2016 Bitfinex, a large bitcoin exchange, found customer bitcoin leaving its wallets in transactions it had not authorized. The exchange took its platform offline and confirmed within a day that 119,756 bitcoin had been taken, worth about $66 million at the time. CoinDesk, reporting the next day, called it the largest loss of bitcoin by an exchange since Mt. Gox in 2014 and noted that the bitcoin price fell nearly 20 percent on the news.

Court documents later put the count at 119,754 bitcoin, moved in more than 2,000 unauthorized transactions to a single outside wallet, and valued the haul at about $71 million. The two counts differ by two coins and the dollar figures by a few million because they were measured on different days at different prices; the story is the same. The receiving addresses are documented at Bitfinex 2016 hack destination addresses.

What made the theft embarrassing was that Bitfinex had a security arrangement designed to prevent exactly this. Since 2015 it had held customer coins in multi-signature wallets with the custody firm BitGo, meaning a transaction needed two of three keys, one of which BitGo held. Court filings say only that the attacker used “advanced hacking tools and techniques” to get into Bitfinex’s network. How the wallets were defeated has never been spelled out in the public record. Who did it eventually was.

Bitfinex spread the loss across every customer, then paid it back in tokens

Bitfinex could not simply absorb the loss, which CoinDesk put at about $72 million. Instead it did something unusual: it reduced every customer’s balance by about 36 percent, whether or not that customer held bitcoin or had been touched by the theft, and issued each of them a BFX token for every dollar lost, with the loss converted to dollars at settlement prices from 3 August 2016.

In its own FAQ, published on 26 August 2016, Bitfinex said “it is our full intention to redeem all BFX tokens for their face value of $1” and laid out four ways it might do so: recovering the stolen coins, outside investment, redeeming tokens over time out of trading revenue, or swapping tokens for shares in the company. It also said it had moved remaining coins into multi-signature cold storage, rebuilt its servers and commissioned a security audit before reopening.

The market did not believe it at first. The tokens traded between 49 and 65 cents through 2016. But Bitfinex bought back 1 percent of them in September 2016, the price had climbed to 89 cents by March 2017, and on 3 April 2017 the exchange redeemed every remaining token at $1, eight months after the breach. Customers were made whole in dollars, not in bitcoin, which is not the same thing when the price has moved in between.

For five years, most of the stolen coins did not move

Then the coins sat. According to the affidavit filed when arrests were finally made, beginning in January 2017 a portion of the stolen bitcoin started leaving the wallet in “a series of small, complex transactions across multiple accounts and platforms,” including deposits into AlphaBay, a darknet market that was used as a pass-through to break the trail. Our page on the January 2017 movement follows that activity on the chain.

But the majority never left. The Justice Department said in February 2022 that roughly 25,000 of the stolen coins had been moved out over five years through a complicated laundering process, while more than 94,000 remained in the wallet that first received them. Anyone could see them sitting there. Nobody could spend them without the keys, and nobody knew who had the keys.

That long stillness is why the case matters beyond Bitfinex. Coins cannot be hidden on Bitcoin; they can only be left alone or moved, and moving them creates evidence. Years of chain analysis, exchange records and search warrants eventually connected the wallet to a person. If you want the mechanics, Is Bitcoin anonymous? explains what the ledger shows and what it does not.

February 2022: a decrypted file, 94,000 coins and two arrests

On 31 January 2022, agents acting on a search warrant for the online accounts of Ilya Lichtenstein decrypted a file saved in his cloud storage. It contained a list of 2,000 bitcoin addresses and their private keys, the secrets that let you spend the coins at those addresses. The addresses were the ones that had received the Bitfinex coins. Using the keys, the government moved about 94,636 bitcoin into its own custody, worth more than $3.6 billion at the time. That address is documented at the DOJ’s 2022 Bitfinex seizure address.

On 8 February 2022, Lichtenstein and his wife, Heather Morgan, were arrested in Manhattan and charged with conspiracy to commit money laundering and conspiracy to defraud the United States. The Deputy Attorney General called it the department’s largest financial seizure ever. The complaint described the laundering methods: fictitious identities, automated transactions, deposits into darknet markets and exchanges followed by withdrawals, “chain hopping” into other cryptocurrencies, and US business accounts used to make the money look ordinary.

The arrests were for laundering, not for the hack. A complaint is an allegation, and at that point the government had not said in public who broke into Bitfinex. That distinction held for eighteen months.

Guilty pleas in 2023, sentences in 2024, and an early release

On 3 August 2023 both pleaded guilty, and Lichtenstein admitted the theft itself. According to the Justice Department, he used “advanced hacking tools and techniques” to get into Bitfinex’s network, authorized the transactions that moved 119,754 bitcoin, then went back in and deleted access credentials and log files to cover his tracks. Only afterward did he enlist Morgan to help launder the proceeds. The plea announcement added detail: mixing services called Bitcoin Fog, Helix and ChipMixer, and a portion of the money converted into gold coins that Morgan buried. By then the government had seized roughly $475 million more tied to the hack.

And the coins? Prosecutors have asked the court to return the roughly 94,000 recovered bitcoin to Bitfinex. What that means for the customers who took the 2016 haircut, and for those who swapped their tokens for shares, is a matter for Bitfinex and the court, not for this article.

What the Bitfinex hack teaches

First, an exchange is a company holding your coins. When it is breached, you are a creditor, and what you get back depends on the company’s choices and its solvency. Bitfinex chose to socialize the loss and paid it off in dollars within eight months; Mt. Gox, two years earlier, could not, and its creditors waited far longer. Our dossiers on the history of Bitcoin exchanges and the Mt. Gox collapse go deeper, and Bitcoin wallets explained covers the alternative of holding your own keys.

Second, the Bitcoin network did what it was designed to do throughout. It recorded the theft, recorded the laundering, and kept the evidence for years until investigators could read it. The theft happened inside Bitfinex’s systems, not inside the protocol. That is a distinction worth keeping in mind whenever a headline says “bitcoin was hacked.”