Skip to content

How a Walmart Gift Card Helped Solve a $4.5 Billion Bitcoin Theft

Leer en Español

[Leer en español]

In 2016, an account at cryptocurrency broker Bitfinex was hacked and Bitcoin tokens worth $4.5 billion were mined. For years, clues to the fraud eluded federal authorities, however, a small Walmart gift card for $500 was the key to solving the mysterious theft.

That Walmart gift card and a dozen others, including from Uber, Hotels.com and PlayStation were linked to an email belonging to a couple residing in a luxury Manhattan apartment; Ilya “Dutch” Lichtenstein and Heather R. Morgan.

Authorities arrested the couple after recovering nearly $3.6 billion in stolen Bitcoin, making it the largest financial seizure in the Department of Justice history.

The couple had been together for seven years, their lawyer claimed during the trial. While Mr. Lichtenstein was an introverted programmer who emigrated from Russia to the United States with his family at age six, Morgan was a columnist for Forbes where she described herself as a digital security expert.

In 2016, a group of hackers used malware to infiltrate the Bitfinex network and move bitcoin through more than 2,000 unauthorized transactions to other accounts at the crypto broker.

LasAuthorities noted that although the Walmart gift car was requested from an American address, the email came from a host in Russia. (EFE)

According to the investigation, the money remained unmoved until 2017, when it began to be transferred in a series of small transactions. The stolen bitcoin began to be sent through AlphaBay — a marketplace operating on the dark web — to different newly created accounts on various cryptocurrency exchanges.

Some of the exchanges upon receiving such large sums of money asked for identity verification from the users behind the new accounts, however, they received no response from the couple; accounts with deposits of over $300,000 were completely abandoned.

All Bitcoin transactions are public, so these can be verified on the blockchain. In 2017, Alphabay was taken down and authorities were able to prove that wallets used the site on the dark web to make transactions.

Prosecutors proved that between February 2019 through December 2020, the couple moved up to the equivalent of $7.8 million in bitcoin through a series of accounts on various crypto exchanges. One of the wallet addresses used by the alleged fraudsters with the coding 36B6 caught the attention of prosecutors.

On May 3, 2020, a transaction came from wallet 36B6 to a crypto exchange that also sells gift cards. The transaction was finalized with the purchase of a Walmart gift card for $500, the particularity is that the purchase was made through an email registered in Russia.

The curious thing is that although the email was Russian, the transaction was made from a laptop in New York, as identified by the location of the laptop’s IP address. Additionally, part of the gift cards were redeemed by Morgan, who used his original name, one of his emails and listed two U.S. residential addresses.

Walamrt’s gift card was the key clue to locating the couple who resided in a luxury apartment on Wall Street. (EFE)

Prosecutors asked Magistrate Zia Faruqui to issue a warrant to investigate the emails associated with the Walmart gift card, a request that was approved in August 2021.

The couple learned of the investigation because an internet provider informed them that federal authorities requested information about the IP detected from Mr. Lichtenstein’s laptop.

After having this information, the couple rushed to get married, since in the State a person cannot be compelled to testify against his or her spouse, and announced plans to have a child by in vitro insemination.

On January 5 of this year, federal agents arrived at the couple’s Wall Street apartment with a search warrant to search the premises. At the apartment, investigators seized a plastic bag marked “burner phone,” $40,000 in cash and more than 50 electronic devices.

According to prosecutors, the couple opted to remain outside their home while the search was ongoing. Morgan reportedly tried to leave with a mobile phone, which she attempted to block, but was intercepted by one of the investigators who asked for the phone, which she refused and the agents had to take it from her in order to confiscate it.

Mr. Lichtenstein had a cloud server, which after being tapped by investigators, a list of several accounts could be found, including those abandoned on cryptocurrency exchanges.

The agents also found a digital file listing the digital wallet in which the couple kept the $3.6 billion in Bitcoin that was seized by federal agents and whose public record was stored on the Blockchain.

Federal Judge Beryl Howell ordered Lichtenstein be remanded into custody on charges of conspiring to launder billions of dollars stolen in bitcoin.

Economist, writer and liberal. With a focus on finance, the war on drugs, history, and geopolitics // Economista, escritor y liberal. Con enfoque en finanzas, guerra contra las drogas, historia y geopolítica

Leave a Reply