WSJ: How the Feds Tracked Hacked Bitfinex Funds

[pushups44]

Here is a good article by Paul Vigna of WSJ: https://www.wsj.com/articles/how-the-feds-tracked-down-3-6-billion-in-stolen-bitcoin-11644447110

"The complaint includes flow charts that show the stolen funds moving from Bitfinex through AlphaBay, and across the bitcoin blockchain to the various other accounts the couple had allegedly set up.

"'This likely allowed [the government] to access AlphaBay’s internal transaction logs, which would enable them to trace the stolen Bitfinex funds,' Mr. Robinson said."

[...]

"The authorities said they traced the flow of funds through the unhosted wallets and across exchanges, according to the complaint, finding transactions that landed in accounts on exchanges that the two alleged launderers had in their real names. In one instance, according to the complaint, two of these accounts shared a login from the same location in New York."

[...]

"Mr. Lichtenstein and Ms. Morgan allegedly exchanged some of the bitcoin into other cryptocurrencies, according to the complaint, cashed some out via bitcoin ATMs and used the stolen funds to purchase nonfungible tokens, or NFTs. These digital collectibles have lately become another way crypto thieves launder digital money, the U.S. Treasury Department said last week in a report."

[bbc.reporter]

I have read different interpretations of the story. There were some people in social media that were saying they were the hackers and there are also some people that were saying that they were only the moneylaunderers for the hackers. However, much of those who said that they were accused as the hackers were also saying that they cannot be the real hackers. They speculated that they were only scapegoats. This is head shaking after watching their Tiktok videos.

It also appears Heather Morgan who is one of the accused was a Forbes contributor. This article was written by her hehehe.

https://www.forbes.com/sites/heathermorgan/2020/06/18/protect-your-business-from-cybercriminals/

[pushups44]

I have read different interpretations of the story. There were some people in social media that were saying they were the hackers and there are also some people that were saying that they were only the moneylaunderers for the hackers. However, much of those who said that they were accused as the hackers were also saying that they cannot be the real hackers. They speculated that they were only scapegoats. This is head shaking after watching their Tiktok videos.

It also appears Heather Morgan who is one of the accused was a Forbes contributor. This article was written by her hehehe.

https://www.forbes.com/sites/heathermorgan/2020/06/18/protect-your-business-from-cybercriminals/

She does seem to have a knack for worming her way into seemingly high places. Granted, writing for Forbes is not exactly an extraordinary achievement, but I imagine most smart people would find it rather hard to achieve that. Maybe she is talented at social engineering? Or maybe she uses her looks to disarm people and gain favors from beta males in the media?

She knows how to get past social hurdles, bare minimum. I also agree she was probably just a money launderer rather than the actual hacker of Bitfinex.

[franky1]

more direct link to the legal press release
https://www.justice.gov/opa/press-release/file/1470186/download

entertaining part is.
they investigators tracked the theives spending to buy gift cards, using emails linked to a cloud hosting service where by investigators gained access to said cloud hosting and found the file containing the private keys and records of lots of accounts they used with different exchanges

On or about May 3, 2020, Cluster 36B6mu sent approximately 0.057 BTC directly
to VCE 10. VCE 10 is a business that sells prepaid gift cards in exchange for BTC. Records from
VCE 10 showed that this specific transaction was for the purchase of a $500 gift card to Walmart
from an account registered with an email address hosted by a provider in Russia and conducted
via an IP address resolving to a New York City-based cloud service provider (“Cloud Provider
1”). Records from Cloud Provider 1 showed that the IP address was leased by an account in the
name of LICHTENSTEIN and tied to Lichtenstein Email 1.

Lichtenstein Email 2 was held at a U.S.-based provider that offered email as well
as cloud storage services, among other products. In 2021, agents obtained a copy of the contents
of the cloud storage account pursuant to a search warrant. Upon reviewing the contents of the
account, agents confirmed that the account was used by LICHTENSTEIN. However, a significant
portion of the files were encrypted.

On or about January 31, 2022, law enforcement was able to decrypt several key
files contained within the account. Most notably, the account contained a file listing all of the
addresses within Wallet 1CGA4s and their corresponding private keys. Using this information,
law enforcement seized the remaining contents of the wallet, totaling approximately 94,636 BTC,
presently worth $3.629 billion,

a $500 giftcard cost them their freedom and $billions

[bbc.reporter]

@franky1. Do you trust this official press release to be the real story? I reckon real hackers and moneylaunderers who have control to more than $3 billion in bitcoin might be more careful and smarter. The skeptical me is beginning to think that those people in social media who speculate that they are only scapegoats might be correct. Would it be shocking if the hackers was a group commisioned by a corrupt government intelligence agency?

[bittraffic]

@franky1. Do you trust this official press release to be the real story? I reckon real hackers and moneylaunderers who have control to more than $3 billion in bitcoin might be more careful and smarter. The skeptical me is beginning to think that those people in social media who speculate that they are only scapegoats might be correct. Would it be shocking if the hackers was a group commisioned by a corrupt government intelligence agency?

Press releases are just some sort of making people think they got the culprits so everything is safe and sound. But it's far from the truth usually. These do doesn't look like a hacker. They are old enough to understand the consequences if they truly are the ones who got the skills to penetrate servers.

Having a TikTok account and posting thier faces on social media feel like they are celebrities doesn't look like a hacker will be fond of doing. The people who can hack exchanges are not scriptkiddies.

[bbc.reporter]

@bittraffic. Agreed. There are many people who are also very skeptical of this. It really appears that the government wants everyone to accept that their official press release is really how the story transpired, however, can we trust the government? We know they have always lied to the people.

[Ozero]

Yes, the story is a bit confusing, and, apparently, will continue. Therefore, to combat hackers and all sorts of scammers, KYC for cryptocurrency exchanges as user identification is necessary and very useful. In any case, this is a fairly successful operation by the US law enforcement agencies. After all, it’s not every day that about 95,000 stolen bitcoins worth $3.6 billion are seized. Will the bitcoins be returned to the victims? Again, if the victims used the exchange anonymously, it would be practically very difficult for them to prove that it was they who stole bitcoins from them. The regulation of cryptocurrencies by states has a certain positive role.

[pooya87]

@franky1. Do you trust this official press release to be the real story? I reckon real hackers and moneylaunderers who have control to more than $3 billion in bitcoin might be more careful and smarter. The skeptical me is beginning to think that those people in social media who speculate that they are only scapegoats might be correct. Would it be shocking if the hackers was a group commisioned by a corrupt government intelligence agency?

Have the authorities recovered any funds or is it just tracking and arresting some people? Because it can be a determining factor, for example if there is no funds recovered (the exchange and the victims have to be paid) that means there is a very high chance that the story is fake and as you said these people are scapegoats or maybe just the foolish launderers who don't know who the actual hackers are.

Keep in mind that historically speaking it is not unheard of to see hackers being caught this way. There has been many cases of them using Coinbase and were caught easily!!!

[Kakmakr]

The thing is, the moment when Crypto currencies touch centralized Fiat services that adhere to KYC reguirements.... ALL pseudo-anonymity is gone. They used Crypto exchanges that has to report to law enforcement agencies and that is why their real identities were exposed.

It does not say if these coins were pushed through Mixer services, because that would have been interesting to see if they can still trace it, once it goes through Mixer services. (Also which Mixer service was used)

I do not want to know this because I want to do something illegal, but if I make donations to Wikileaks or some other organization... I want to know that my pseudo-anonymity will be safe.

[pooya87]

It does not say if these coins were pushed through Mixer services, because that would have been interesting to see if they can still trace it, once it goes through Mixer services. (Also which Mixer service was used)

It would be interesting to know but I don't think they will ever reveal it if they had been able to trace any bitcoins that went through a mixer. Imagine if one of the centralized mixers was a honeypot, if they said anything about it that service dies right away because nobody would ever use it again.

[witcher_sense]

It does not say if these coins were pushed through Mixer services, because that would have been interesting to see if they can still trace it, once it goes through Mixer services. (Also which Mixer service was used)

Interestingly, they used Alphabay darknet marketplace to launder some of the stolen coins, but federals have managed to seize and shut down this market and got access to all transaction logs that would later be used to identify our suspects. By default, Alphabay worked just like a mixer: it pooled all incoming bitcoin transactions together, mixed them in some way and paid clients from a different, unlinked to a previous transaction, address making it impossible to find a connection between incoming and outcoming transactions. Unless you had access to logs, which Alphabay recorded and kept for an unknown reason. The conclusion is no matter how a mixer is good at obfuscating transaction history, you are in trouble if they are covertly recording all that is happening during a mixing process.

[Darker45]

The case has grown fuzzy after reasonable doubts are raised. I have actually been doubting the facts stated by the justice department ever since I read the news. I just couldn't believe how lax these two launderers seem when they are actually hiding billions of money. Not only are they keeping a huge amount of treasure, this treasure is stolen. They must have been very much aware that the authorities are waiting for just a single false move from them.

What I'm somehow convinced of is that they are not the hackers, although it is mind-boggling how the hacker has trusted them so much so that he/she sent all the funds to them to launder. Not to mention that the way they do things, they don't seem to be experienced and reliable.

What's sure at this point is that what really took place is not the one that is being narrated in the media.

[cryptomaniac_xxx]

It does not say if these coins were pushed through Mixer services, because that would have been interesting to see if they can still trace it, once it goes through Mixer services. (Also which Mixer service was used)

It would be interesting to know but I don't think they will ever reveal it if they had been able to trace any bitcoins that went through a mixer. Imagine if one of the centralized mixers was a honeypot, if they said anything about it that service dies right away because nobody would ever use it again.

Or they can just used any 2nd tier exchanges out there or maybe just fly by night without KYC or even i there is KYC, as reported they have used fake identifies. So they know what they are doing, but maybe they become too complacent and think that they are off the hook and that they are untraceable. Also interesting what tools the government did used to crack the blockchain and find the foot print.

[hatshepsut93]

The thing is, the moment when Crypto currencies touch centralized Fiat services that adhere to KYC reguirements.... ALL pseudo-anonymity is gone. They used Crypto exchanges that has to report to law enforcement agencies and that is why their real identities were exposed.

They probably believed that their coins looked clean and they would be able to spend their fiat openly, because what's the point of stealing millions of dollars if you can't buy a house or a car with them? And let's ask ourselves, how many crypto criminals do get away with their crimes? All these hacks, scams, rug pulls, pump and dump schemes, ponzis and so on, and there's has been so little arrests made. So it's not like tracing all transactions of a person who submitted their KYC data is that easy.

[kryptqnick]

It's interesting to see how NFTs are now also a part of money laundering schemes (I've seen them being a result of stolen intellectual property before, but not used for money laundering), and the story of tracking the lost coins is also worth attention. It's great that they were caught and money was seized because it shows that Bitcoin doesn't prevent the work of law enforcement, and I also liked the part franky1 pointed out about a $500 giftcard to Walmart. I do trust that it was the case because being reckless is what usually get people caught (just recall how Ross Ulbricht was caught, using an email containing his name to tell people about Silk Road on the Internet).

[Anonylz]

What i find a bit surprising is how this couple was able to pull such a huge heist and cashing out becomes a problem! From the explanation above it seems they were lost on how to go about spending the money,
I thought every good hacker would have a correct cash-out plan, to me it seems, these two are not the real brain behind the heist.
The sad part is the media will capitalize on news like this to paint crypto bad the more, at least the authorities where able to apprehend them.

[dothebeats]

I am inclined to think that they are just part of the hacking group, perhaps scapegoats or those who collect initial info but not mainly the brains behind the actual hack. They are so fond of social media, and they have done things that could obviously put their identities in peril, and normally those who do some hacking do not engage in these kinds of activities.

The true hackers are still yet to be jailed, I believe. These two doesn't seem to be the masterminds of the heist from their most recent activities.

[franky1]

@franky1. Do you trust this official press release to be the real story? I reckon real hackers and moneylaunderers who have control to more than $3 billion in bitcoin might be more careful and smarter. The skeptical me is beginning to think that those people in social media who speculate that they are only scapegoats might be correct. Would it be shocking if the hackers was a group commisioned by a corrupt government intelligence agency?

Have the authorities recovered any funds or is it just tracking and arresting some people?

the 119k coins where split up where ~95k remained untouched[Wallet 1CGA4]untill 2022..... and the other ~24k where the funds were split up and then looped through alphabay and several exchanges between 2017-2021
some of the 24k coins were spent, released, cashed out..  and some where frozen by exchanges and seized in some instances between 2017-21.
but the main lot the ~95k[Wallet 1CGA4] never went through an exchange not cashed out by the pair, nor seized in 2017-21.
but instead seized in 2022

Between January 31, 2022, and February 1, 2022, law enforcement obtained approval to execute a lawful seizure
supported by probable cause under exigent circumstances and used the private keys from
LICHTENSTEIN’s file to seize Wallet 1CGA4’s remaining balance of approximately 94,636
BTC, worth $3.629 billion

thus more then 100k coins(over 5 years) but less than 119k coins HAVE BEEN SEIZED from different places, over 5 years to the 4th of february.
and the pair have been arrested on the 8th of february(now on ankle monitoring house arrest)

[OgNasty]

"Mr. Lichtenstein and Ms. Morgan allegedly exchanged some of the bitcoin into other cryptocurrencies, according to the complaint, cashed some out via bitcoin ATMs and used the stolen funds to purchase nonfungible tokens, or NFTs. These digital collectibles have lately become another way crypto thieves launder digital money, the U.S. Treasury Department said last week in a report."

Does this mean that there won't be as many fresh NFT mints shooting up 100x before crashing miserably while some get rich and others are left holding the bag?  The funny thing is, I bet they were actually making a fortune doing this.  They probably went from thinking about how they'd launder their billions to wondering why everyone isn't rich since it's so easy to pump and dump. 

Has anyone discovered their opensea profile yet (I'm sure they probably had hundreds).  It would be very fascinating to see their transaction history and see if they really were making a fortune flipping NFTs while trying to launder their funds.  Would surprise me at all...