In January 2021, the US Department of Justice was closing in on its biggest financial bust ever: the seizure of more than $US3.6 billion ($4.9 billion) in cryptocurrency.
Almost 120,000 bitcoins had been illegally taken from users’ accounts in 2016, from one of the world’s largest virtual currency exchanges, Bitfinex.
In hunting down the stolen bounty over several years, investigators followed a trail of clues that eventually led them to an unconventional would-be New York power couple.
Social influencer, writer, entrepreneur and amateur rapper Heather Morgan and her husband Ilya Lichtenstein, a Russian-American tech entrepreneur, now face up to 25 years in jail if found guilty of conspiring to launder stolen Bitcoin worth billions of dollars.
The alleged secret lives of the outwardly goofy duo — involving burner phones and multiple identities — have perplexed onlookers, rocked the cryptocurrency world and inevitably already inspired talk of a Netflix doco.
While the the trial date has not yet been set, it looks set to deliver on drama, with prosecutors alleging Lichtenstein and Morgan’s activities “appear pulled from the pages of a spy novel”.
Razzlekhan the rapper, ‘crocodile of Wall Street’
Before the January 5 raid on the couple’s Wall Street apartment, Lichtenstein and Morgan had cultivated an online life preaching the windfalls of tech entrepreneurship and hustle culture.
Morgan appears to have split her time between writing business columns for the likes of Forbes and Inc., dishing out sales and marketing advice, and spitting bars as her rap alterego Razzlekhan — “like Genghis Khan, but with more pizzazz”.
Loading
A shaky video doing the rounds since their arrest shows Morgan kicking off a 2019 speaking engagement with a few lines from Razzlekhan’s Versace Bedouin.
“Razzlekhan, the Versace Bedouin. Come real far but don’t know where I’m headed. Motherf***ing crocodile of Wall Street, silver on my fingers on boots on my feet.”
She goes on to engage the audience with stories of crashing events and engineering herself into all kinds of situations, like the time she and her friend scaled the fence of a local Egyptian landmark, the Baron Palace, and talked the security guard into giving them a tour.
The talk, like her occasional freelance contributions and an overwhelming volume of social media posts, suggest Morgan certainly had a working knowledge of cryptocurrency and entrepreneurship.
Prosecutors noted Morgan’s finance articles, such as Experts Share Tips to Protect Your Business From Cybercriminals, “involved ‘interviewing’ several virtual currency exchange employees who discussed their companies’ anti-money-laundering and anti-fraud protocols”.
Loading
Lichtenstein, who variously calls himself a tech investor, entrepreneur, coder and “occasional magician” and goes by the name Dutch, had been working on “the first decentralised cloud wallet”.
His social media contributions ranged from Twitter commentary on cryptocurrency and Web 3.0 to a lengthy Facebook ramble about his elaborate marriage proposal, which involved a Razzlekhan appearance on a Times Square billboard.
“As you may know, Heather is not just a tech entrepreneur… she is also Razzlekhan, the fearless rapper. And what better way to propose to an entrepreneur/rapper than with a weird, creative multi-channel marketing campaign?” he wrote in June 2019.
The pair seemingly share a penchant for the awkward and ridiculous and a disdain for social media influencers who take themselves too seriously.
“This is my commentary on social media and how f***in’ superficial and consumerist our society is,” Morgan rants in one TikTok post before trying some super-sized “fluffy pancakes”.
Their involvement in the Bitfinex case has stirred up significant interest. Razzlekhan’s TikTok account has amassed 10,000 new followers since the arrests in early February.
Not all the online commentary has been kind. One Twitter user, sharing a link to the pancake video, observed: “OK. The hackers are not CIA. They are idiots.”
Loading
Tracing hundreds of complicated transactions to find the hidden stash
The colourful details of the defendants’ lives don’t surprise Ari Redbord of TRM labs, a blockchain intelligence company that is following the case closely.
“You have super sophisticated hacking teams, like Lazarus Group out of North Korea… and then you have Russian cyber criminals engaging in ransomware attacks… and then you have hackers and frankly, folks like this,” he said.
“If you’re good with a computer or have a data science background, there really are things you can do to penetrate cyber defences.”
It’s not yet clear exactly how almost 120,000 Bitcoin were stolen in the 2016 Bitfinex hack.
Lichtenstein and Morgan have not been charged with the hack itself.
But they stand accused of laundering a portion of that total, worth $US71 million ($104 million) at the time and now valued at more than $US4.5 billion ($6.1 billion).
Court documents released last month detail how some of the stolen currency has allegedly been laundered “in a series of small, complex transactions across multiple accounts and platforms” involving 2,000 virtual currency addresses all linking back to the hack.
Prosecutors allege the defendants used numerous money laundering techniques, including setting up accounts with fake identities, moving stolen funds in a series of small amounts, and using US-based business accounts to legitimise activity.
Some purchases have allegedly been made with a fraction of the stolen currency — gold, non-fungible tokens (NFTs), even a Walmart giftcard — but for years most of it has been sitting in a virtual wallet apparently untouched.
“We’re still not in a world where you can easily transact, buy stuff with crypto,” said Mr Redbord, a former assistant US attorney specialising in illicit finance.
“So what these people needed to do is figure out a way to off-ramp billions of dollars, with the world watching, with law enforcement watching.
“It is very hard to off-ramp stolen cryptocurrency.”
Burner phones, Clarissa the cat and cold hard cash
In a raid on the couple’s apartment on January 5, officers found the first physical clues of the virtual cash they had been hunting down.
Police seized around 50 encrypted electronic devices, various bags containing multiple SIM cards and cell phones — one of which was labelled “Burner Phone” — and $US40,000 ($54,000) in cash, as well as “what appears to be a substantial amount of foreign currency”.
They also found two books in Lichtenstein’s study, with partially hollowed-out pages to create secret compartments.
At the most recent court hearing for the case, the judge noted that during the search, Morgan told officers she needed to retrieve her pet cat, Clarissa the Bengal, from under the bed.
Loading
She then “positioned herself next to the night stand, which was still holding one of her phones” and reached up to grab the device, repeatedly hitting the lock button.
According to court documents, “law enforcement had to wrest the phone from her hands”.
Even then they still didn’t have, in the words of Federal Judge Beryl A Howell, the “smoking gun”.
That discovery came several weeks later when law enforcement managed to hack into a file on Lichtenstein’s cloud storage account that linked the couple to the 2016 Bitcoin theft.
In it, they found the password to the virtual wallet where almost 95,000 of the stolen Bitcoin was still being stored.
The currency, valued at $US3.6 billion, was seized a few days later in what the Department of Justice said was its “largest financial seizure ever”.
A trip to Russia and frozen embryos
At a court hearing in Washington DC last month, Judge Howell heard arguments on whether or not Lichtenstein and Morgan should be released on bail.
According to court documents, Lichtenstein is a dual Russian-American citizen who “[had] access to numerous fraudulent identities and documents purchased on the darknet, and the ability to easily acquire more”.
“The defendants have established financial accounts in Russia and Ukraine, and appear to have been setting up a contingency plan for a life in Ukraine and/or Russia prior to the COVID-19 pandemic,” prosecutors wrote.
Samson Enzer, a lawyer for the couple, argued in court that the pair were not a flight risk in part because they had stored frozen embryos in New York, which Morgan would need to pursue her dream of starting a family.
Judge Howell: “I don’t want to spend too much on frozen embryos, but that procedure could be done again.”
Mr Enzer: “You would need eggs, you would need good eggs. Those eggs were frozen a long time ago. They’d literally be leaving their future behind if they left.”
The judge appeared to give little weight to the argument, pointing out an alleged 2019 trip to Ukraine.
During that trip, prosecutors allege the couple received a suspicious package from Vladivostok, Russia, delivered to a hotel close to where they were staying in Kyiv.
Around this time the defendant was creating or modifying numerous files in his cloud storage account with notes about false identification documents and “personas” from both Russia and Ukraine.
“It appears that they had been planning a flight to Ukraine or Russia — which is a great place to be travelling right now,” Judge Howell said.
Despite prosecutors’ allegations that she was “extremely hands-on” in the money laundering scheme, Judge Howell upheld an earlier decision to grant Morgan bail, under strict supervision.
She rejected Lichtenstein’s bid to be released on a $US5 million ($6.8 million) bond.
How to social engineer your way out of a bad situation
While the couple were quickly dubbed the Bonnie and Clyde of the cryptoworld, they haven’t been charged with the initial theft of the currency.
No-one has — at least for now.
“There are all kinds of reasons that prosecutors decide what charges to bring against a defendant. It’s possible that it was easier to prove the money-laundering offence than the hack itself,” Mr Redbord said.
“‘Do I think that they committed the hack? I don’t know.
“But I think it would be very strange for someone to commit a hack, and then hand over $US70 million in Bitcoin to this couple for them to launder the funds over the course of four or five years.”
Either way, Morgan may be in need of some of her own advice now.
Her 2019 talk “How to Social Engineer Your Way into Anything” ends with a slide showing a pair of cuffed hands behind bars. The caption reads:
“Finally, how can [you] Social Engineer yourself OUT of a Bad Situation?”
