Bitfinex Hack Convict Released Early Under U.S. First Step Act

Jan 5
2 min read

Key Findings

Ilya Lichtenstein, the cybercriminal behind the 2016 Bitfinex hack, has been released from prison early thanks to the 2018 First Step Act signed by former President Donald Trump.
Lichtenstein was sentenced to 5 years in prison in November 2024 for his role in a money laundering conspiracy related to the Bitfinex hack, where he stole approximately 120,000 bitcoins.
The First Step Act allows inmates to earn credits for good behavior and rehabilitation, potentially shortening their prison terms and supporting reintegration into society.
Despite recovering over 96% of the stolen funds, questions remain about the full extent of the damage caused by the hack and whether the perpetrators have truly compensated for their actions.

Background

In February 2022, Ilya Lichtenstein (35) and his wife, Heather Morgan (32), were arrested for alleged conspiracy to launder $4.5 billion in stolen cryptocurrency from the 2016 Bitfinex hack. Law enforcement also seized over $3.6 billion in cryptocurrency (roughly 95,000 of the stolen crypto assets) linked to the hack.

The Bitfinex Hack

Lichtenstein used advanced hacking tools and techniques to breach Bitfinex's network and fraudulently authorize more than 2,000 transactions, transferring 119,754 bitcoin (then worth approximately $71 million) from Bitfinex to a cryptocurrency wallet under his control.
Lichtenstein and his wife, Heather Morgan, helped launder the stolen funds by using fake identities to set up online accounts, exchanging part of the stolen funds into gold coins and other crypto assets, and using mixing services like ChipMixer.

Sentencing and Early Release

In August 2023, the married couple pleaded guilty to money laundering charges in connection with the Bitfinex hack.
In November 2024, Ilya Lichtenstein was sentenced to 5 years in prison, while Heather Morgan received 18 months of incarceration.
Thanks to the 2018 First Step Act signed by former President Trump, Lichtenstein has been released from prison early and is currently on home confinement, according to a Trump administration official.
Lichtenstein credited his early release to the First Step Act, stating that he remains committed to making a positive impact in cybersecurity.

Concerns and Unanswered Questions

While the majority of the stolen funds have been recovered, there are concerns about the full extent of the damage caused by the Bitfinex hack and whether the perpetrators have truly compensated for their actions.
The collapse in Bitcoin's value following the hack may have irreparably harmed many investors, and it remains unclear if all the affected parties have been adequately addressed.
The lenient sentences and early release of the perpetrators have raised eyebrows, with some questioning whether justice has been fully served in this case.

Sources

https://securityaffairs.com/186551/cyber-crime/the-cybercriminal-behind-2016-bitfinex-hack-released.html
https://thehackernews.com/2026/01/bitfinex-hack-convict-ilya-lichtenstein.html