The Bitfinex Hack (2016): 119,756 Bitcoin and a Six-Year Investigation
In August 2016 attackers took 119,756 BTC from Bitfinex. A factual account of the breach, the BFX tokens, and the 2022 arrests and seizure by US authorities.
On 2 August 2016, the Hong Kong-based exchange Bitfinex announced a security breach. Attackers had moved 119,756 bitcoins out of customer accounts. At the time it was the second-largest theft of bitcoin after Mt. Gox, and the case was only resolved in the courts years later.
What was taken
The stolen coins came from Bitfinex's segregated wallets, which the exchange used to hold margin trading customers' funds separately. The company halted trading and withdrawals while it investigated. Bitfinex also said it was working with law enforcement and a blockchain security firm, and it offered a bounty for the return of the funds. The attackers made around 2,000 transactions, sending the funds to addresses they controlled.
How the wallets were set up
Bitfinex had worked with BitGo, a security provider, on a multi-signature wallet design. In a multi-signature setup, a transaction needs more than one key to be approved. Here, the arrangement required two of three keys, with BitGo holding one of them and Bitfinex another. Because the system was set up so that BitGo's service co-signed withdrawals under certain conditions, the attackers were able to get transactions approved. The details of the technical weakness were disputed by the parties involved, and this article does not try to settle that question.
The incident revealed that multi-signature protection is only as strong as the processes around it. Authorisation logic, rate limits and monitoring matter as much as the cryptography.
How Bitfinex dealt with the loss
Instead of paying out only the customers whose coins were stolen, Bitfinex spread the loss across all account holders. Every customer, including those whose funds had not been touched, saw a reduction of about 36 percent in their balances. In return they received BFX tokens, a record of the debt owed to them, which the exchange committed to repay.
The decision was controversial, but Bitfinex said it was the fairest option. The company later reported that it repaid the tokens in full, in part by letting holders convert them into shares of its parent company. Customers who had been angry at the time of the loss held varying views on the process.
The investigation
The stolen bitcoin sat mostly untouched for years, with small amounts moved over time. Blockchain analysis firms followed the funds as they passed through mixing services and a series of accounts. In January 2022, US authorities seized about 94,000 bitcoin connected to the theft. On 8 February 2022, the US Department of Justice announced the arrest of two people in New York, Ilya Lichtenstein and Heather Morgan, and described the seizure as the largest in its history at that date.
The prosecution relied on records from exchanges, cloud storage accounts and the public ledger. Lichtenstein pleaded guilty in 2023 to conspiracy to commit money laundering, and in November 2024 he was sentenced to five years in prison. Morgan was sentenced to 18 months. Both were later released early: Morgan in 2025 and Lichtenstein in January 2026, with Lichtenstein crediting the First Step Act. The US authorities said the seized funds would be returned to Bitfinex as the victim.
What changed in exchange security
- Cold storage by default. Exchanges increasingly keep the bulk of funds offline and move only small operational amounts through hot wallets.
- Withdrawal controls. Time delays, whitelisting and manual review for large transfers became common.
- Blockchain forensics. The case showed that stolen bitcoin is difficult to cash out unnoticed because the ledger is public. Analysts can follow a trail for years.
How the funds moved
According to court filings by the US Department of Justice, the stolen bitcoin was moved through a large number of accounts, converted between different cryptocurrencies and in part passed through the darknet market AlphaBay. The filings describe the defendants as using automated tools and layers of transactions designed to make tracing harder. Investigators were nonetheless able to follow the activity using blockchain analysis combined with records from the companies that provided accounts and storage. The case is often used as an example of how a public ledger can support an investigation years after the event. For help with everyday operations on your own hosting, see our knowledge base.
Timeline
| Date | Event |
|---|---|
| 2 Aug 2016 | Hack disclosed; 119,756 BTC moved |
| Aug 2016 | Loss shared among customers; BFX tokens issued |
| Jan to Feb 2022 | Seizure of about 94,000 BTC and two arrests |
| 2023 to 2024 | Guilty plea and sentencing of the main defendant |
Keeping the numbers in context
Bitcoin's price moved a great deal between the theft and the seizure, so the dollar value reported at each point is very different. News coverage of the 2022 seizure described a value of several billion dollars, but the amount of bitcoin itself, not the dollar figure, is the stable fact. This article does not speculate on price.
A practical lesson for site owners
If you operate any system that handles money, layered controls are better than relying on one safeguard. For a website, that means strong passwords with two-factor sign-in, regular backups and server-level protections. The Zebra Hosting security page describes what we provide, and what remains your responsibility as a site owner.
