Skip to content
Degrees of SatoshiFollow the connections.

On-chain record · high source confidence

Bitfinex 2016 Hack Destination Addresses

On 2 August 2016 the exchange Bitfinex was breached and coins were moved out in more than two thousand transactions. The U.S. Attorney's Office for the District of Columbia states that Ilya Lichtenstein hacked Bitfinex and that 119,754 bitcoin were transferred to a wallet under his control; he pleaded guilty to money laundering conspiracy in August 2023 and was sentenced to 60 months in November 2024. His wife, Heather Morgan, also pleaded guilty. A community-compiled CSV of the 2,072 unauthorized transactions circulates publicly and its total matches the figure in the court record; the addresses here are drawn from it.

Research author: · Group author: · Published 2026-08-06 · Internal review: · Corrections

Bitcoin ancestry star map for Bitfinex 2016 Hack Destinatio…, 5 degrees from the first bitcoin 1°2°3°4°5°SATOSHI2017201720172018BITFINEX 2016 HACK DEST…1CGA4s…zD9w5° FROM THE FIRST BITCOIN
5 hops from the working origin.
1 of 6 documented addresses
1CGA4srJbPWhtJb7ezgY6GQf4PKhFuzD9w

the address whose prefix names 'Wallet 1CGA4s' in the DOJ statement of facts; received 567.48 BTC in the hack

Era
2016
Script
P2PKH
First seen
August 2016
Connected
October 2018
Evidence
4 sources
First seen
August 2016
Connected
October 2018
Route display ID
5°-6491-0280Display identifier only — not proof of ownership.
2 additional population comparisons
Same-era contextCloser than 81.3% of scored addresses first seen in 2016
Connection contextConnected earlier than 61.3% of scored 5° addresses

Evidence boundary

What is — and is not — established

The DOJ's public filings name the receiving wallet only by a six-character prefix, 'Wallet 1CGA4s' - the statement of facts PDF fetched this session renders it as 'Wallet : 1CGA4s' in a flow diagram and contains no full address strings. The full address 1CGA4srJbPWhtJb7ezgY6GQf4PKhFuzD9w comes from the public MrChrisJ gist, not from the court record, and the prefix match is the link between them. Verification performed this session: all 2,072 receiving addresses in that CSV pass base58check, the file totals 119,754.81 BTC against the court record's 119,754 bitcoin, and 1CGA4srJ... shows 567.49 BTC received on mempool.space. The CSV writes dates day-first (its '2016-02-08' rows are 2 August 2016). Lichtenstein and Morgan are named here only because their convictions are matters of public court record. These are hack destination addresses, not addresses belonging to Bitfinex.

The dossier

Evidence record

Address record

Role
the address whose prefix names 'Wallet 1CGA4s' in the DOJ statement of facts; received 567.48 BTC in the hack
Script
P2PKH
Category
Incident record
Source confidence
high
Catalog reviewed
2026-08-06
View all 6 documented addresses
  1. 011CGA4srJbPWhtJb7ezgY6GQf4PKhFuzD9wP2PKH · representative
  2. 021NAgFZKa8YFMKVedJJwCwqYc4nZgGqU1vpP2PKH
  3. 031QDBWKgfftwuraEasMGSUvj9PPrswZv19qP2PKH
  4. 041MsHGbSb1qfZmP48CZJoNvM39XU6BsTEWMP2PKH
  5. 0512i7A7XRL8hpNfxZT9Y5KnoPUtwZvWpahCP2PKH
  6. 0617SrKbMSYR1cbBBKvgvo341pUz4frdxim9P2PKH

Source ledger

4 cited
  1. gist.github.com/…/4a959a51a0…fc1d87
  2. justice.gov/…/2016-bitfinex-hack
  3. justice.gov/…/statement_of_facts.pdf
  4. irs.gov/…/bitfinex-h…rrency
Trace another address