How The Feds Used A Cloud Warrant And Walmart Gift Card To Track Down $4B In Stolen Bitcoin

How The Feds Used A Cloud Warrant And Walmart Gift Card To Track Down $4B In Stolen Bitcoin


Photo: CNN

Netflix is already on it, making a docuseries about how federal agents nabbed the alleged masterminds behind the notorious $4.5 billion crypto heist by using a cloud warrant, as well as by tracing a Walmart gift card purchase.

The Justice Department arrested the married couple on Feb. 8 and recovered 94,636 of the 119,754 Bitcoins stolen in a 2016 Bitfinex hack. The recovered Bitcoins today are valued at more than $3.6 billion. It was the largest financial seizure in U.S. history.

Ilya Lichtenstein, 34, and Heather Morgan, 31, laundered 21 percent of the stolen Bitcoin by setting up fake accounts, swapping BTC for gold, and buying $500 gift cards from Walmart, Uber, Hotels.com and Playstation. 

The Feds discovered the unlaundered 79 percent of stolen cryptocurrency sitting in Lichtenstein’s cloud storage account, which law enforcement recovered after getting a search warrant for an encrypted cloud account belonging to Lichtenstein.

Lichtenstein “made the monumental mistake of storing the private keys in plain text on this service. This allowed the DOJ to get access to 94,000 BTC,” Medium reported.

 In all, the Fed recovered $3.6 billion from the couple, who seemed to have trouble laundering all the Bitcoins.

Listen to GHOGH with Jamarlin Martin | Episode 74: Jamarlin Martin Jamarlin returns for a new season of the GHOGH podcast to discuss Bitcoin, bubbles, and Biden. He talks about the risk factors for Bitcoin as an investment asset including origin risk, speculative market structure, regulatory, and environment. Are broader financial markets in a massive speculative bubble?

Investigators traced the movement of the Bitcoin on the blockchain, the permanent fixed electronic ledger that records each time a Bitcoin moves to a new digital wallet, The New York Times reported.

Lichtenstein and Morgan conspired to launder the stolen Bitcoin by moving it around through more than 2,000 unauthorized transactions that eventually led to a digital wallet under Lichtenstein’s control, the DOJ said in a statement.

Law enforcement gained access to the wallet by decrypting a file saved to Lichtenstein’s cloud storage account
which had been obtained through a search warrant. The file contained a list of 2,000 virtual currency addresses with corresponding private keys. Blockchain analysis confirmed that almost all the addresses were directly linked to the hack, according to a DOJ statement of facts.

In one transaction, Lichtenstein sent approximately 0.057 BTC directly to VCE 10, a business that sells prepaid gift cards in exchange for BTC. Records from VCE 10 showed a transaction for the purchase of a $500 gift card to Walmart from an account registered with an email address hosted by a provider in Russia and conducted via an IP address resolving to a New York City-based cloud service provider.

During the 2016 Bitfinex hacker attack, the stolen Bitcoin was valued at around $70 million, according to officials. As a result of the hack, the price of Bitcoin dropped sharply, Wall Street Journal reported. The stolen Bitcoin was valued at around $4.5 billion in February 2022.

Morgan, who bills herself as a “Surrealist Artist, Rapper,” and Lichtenstein, who has both U.S. and Russian citizenship, face possible 20-year jail sentences.

Photo: CNN