Loading story…
Ilya Lichtenstein, who was convicted for his role in laundering funds from the 2016 Bitfinex cryptocurrency exchange theft, has been released early from prison after serving approximately 14 months of a five-year sentence. His early release was granted under the First Step Act, a prison reform law signed by President Trump, and was confirmed by both Lichtenstein and a White House official. Lichtenstein expressed gratitude for the support he received and indicated his intention to contribute positively to the cybersecurity field.
Heather Morgan, Lichtenstein's wife and co-conspirator in laundering the stolen cryptocurrency, also received an early release from her sentence and publicly celebrated her husband's return. The couple, known for their high-profile arrest and subsequent media attention, had pleaded guilty to laundering billions in stolen Bitcoin. The Bitfinex heist and their story have since been featured in a Netflix documentary, highlighting the scale and notoriety of the case.
See the reporting duties and controls this puts on the clock.
10 events from the most recent confirmed update back to the earliest known activity.
By early January 2026, Lichtenstein had been released after serving about 14 months of his five-year sentence and placed on home confinement. Reports attribute the early release to the First Step Act, and he publicly said he intended to contribute positively to cybersecurity.
By late 2025, Heather Morgan had been released early from her 18-month sentence. Reports say her release, like Lichtenstein's, was enabled by sentence-reduction provisions under the First Step Act.
In 2024, Heather Morgan was sentenced to 18 months in prison for her role in laundering funds from the Bitfinex hack. Her sentence was shorter than Lichtenstein's and she was later released early.
In November 2024, Ilya Lichtenstein was sentenced to five years in prison for laundering cryptocurrency stolen from Bitfinex. The sentence followed his guilty plea in the federal case.
A 2024 Netflix documentary brought renewed public attention to the Bitfinex hack and the couple's laundering case. The production contributed to the case's broad media visibility.
In 2023, Lichtenstein and Morgan pleaded guilty to charges tied to laundering proceeds from the 2016 Bitfinex hack. Their admissions confirmed their role in moving and concealing the stolen cryptocurrency.
In 2022, U.S. law enforcement seized about 94,000 bitcoin linked to the Bitfinex hack, valued at roughly $3.6 billion at the time. The recovery was described as one of the largest asset seizures in U.S. history.
In February 2022, U.S. authorities arrested Ilya Lichtenstein and Heather Morgan for laundering cryptocurrency stolen in the Bitfinex hack. The case tied the couple to billions of dollars in stolen digital assets.
In 2018, the U.S. enacted the First Step Act, a criminal justice reform law that later enabled sentence reductions and early release for some federal inmates, including Lichtenstein. Multiple reports cite this law as the basis for his early release.
In 2016, Bitfinex was hacked and 119,754 bitcoin were stolen by Ilya Lichtenstein, then worth about $71 million. The theft became one of the largest cryptocurrency heists on record.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
6 references tracked. Mallory keeps watching after this page renders.
hackread.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourcesecurityaffairs.com
Open sourcecyberscoop.com
Open sourcego.theregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A U.S. federal court sentenced **Daren Li** (42), a dual citizen of **China** and **St. Kitts and Nevis**, to **20 years in prison in absentia** for conspiring to launder proceeds from an international **“pig butchering”** cryptocurrency investment/romance-baiting fraud that stole more than **$73 million** from victims. Li pleaded guilty in **November 2024** and admitted that at least **$73.6 million** in victim funds was deposited into accounts controlled by his group, with a significant portion routed through **U.S.-based shell companies**; the operation was tied to scam centers in **Cambodia** and relied on a network of money launderers to move funds through U.S. bank accounts and onward to domestic/international accounts and crypto platforms to obscure origins. Li was arrested in **April 2024** at **Hartsfield-Jackson Atlanta International Airport**, but fled before sentencing in **December 2025** after cutting off his ankle monitor; U.S. authorities have not publicly confirmed his current whereabouts and indicated they will work with international partners to return him to serve the sentence. The court also imposed **three years of supervised release** following imprisonment, and reporting noted that multiple co-conspirators have pleaded guilty, with Li described as the first sentenced defendant directly involved in receiving victim funds.
Jun 29, 2026
U.S. prosecutors and courts advanced multiple cases tied to large-scale cryptocurrency fraud and laundering operations that targeted American victims through fake trading platforms and social-engineering lures. In one California case, **Jingliang Su**, a Chinese national, was sentenced to 46 months in prison after admitting he helped launder more than **$36.9 million** stolen from 174 victims by a scam network operating from Cambodia; the court also ordered more than **$26.8 million** in restitution. Authorities said the fraud used unsolicited messages, calls, texts, dating platforms, and bogus crypto-investment websites to persuade victims to transfer funds, which were then routed through U.S. shell companies, bank accounts, Deltec Bank in the Bahamas, and **Tether (`USDT`) wallets** controlled abroad. In a related prosecution, **Daren Li**, a dual citizen of China and St. Kitts and Nevis, pleaded guilty to conspiracy to commit money laundering after authorities said he and co-conspirators moved more than **$73 million** in victim proceeds through shell companies, U.S. financial accounts, wire transfers, and conversion into `USDT`; he was later sentenced to **20 years in federal prison**. The cases form part of a broader Justice Department crackdown on transnational crypto-enabled investment scams and money-laundering networks, with officials reporting that multiple co-conspirators have pleaded guilty and that the U.S. Secret Service played a central investigative role.
Jun 29, 2026
Evan Tangeman, a 22-year-old from Newport Beach, California, was sentenced to 70 months in prison after pleading guilty to a `RICO` conspiracy tied to a cybercriminal network that stole roughly **$230 million to $260 million** in cryptocurrency from victims. Prosecutors said Tangeman laundered at least **$3.5 million** between October 2023 and May 2025 for the group, which allegedly stole more than **4,100 Bitcoin** from a Washington, D.C., victim in August 2024 and used the proceeds to fund luxury homes, private jets, high-end vehicles, private security, and other lavish purchases. Authorities said the organization, identified by law enforcement as the **Social Engineering Enterprise**, targeted wealthy cryptocurrency holders using stolen and dark-web-sourced data, spoofed phone numbers, impersonation of Google and Gemini support staff, and remote-access tools including **AnyDesk** to obtain Bitcoin Core private keys. Investigators alleged the group then obscured the proceeds through mixers, exchanges, peel chains, pass-through wallets, and VPNs, while Tangeman also helped rent properties under false identities and destroy devices after arrests of key members. Another alleged launderer, **Kunal Mehta**, has also pleaded guilty and is awaiting sentencing.
Jun 29, 2026