In 2016, Bitfinex was hacked for 119,754 Bitcoins. The hacker served 14 months in prison before being released. The court ruled that the exchange was the sole victim, with 94,636 coins accounting for 30% of the US strategic reserves. LEO tokens are betting on a 60% premium outcome.
(Background: Will the US government return the 90,000 Bitcoins stolen from Bitfinex? K33: The 60% premium on LEO tokens suggests legal proceedings are nearing completion.)
(Additional context: Bitfinex report: ETF weakness and whale sell-offs create a double pressure, with Bitcoin at $53,000 becoming a key defensive line.)
Table of Contents
Toggle
- That night, 2,072 transactions
- Six years in stealth
- The ledger remembers
- The US Treasury’s unexpected asset
- Individual users, who will compensate?
- The birth of LEO compensation tokens
- The buyback and burn mechanism of LEO
- Three possible outcomes and one market
On January 15, 2026, the U.S. Department of Justice submitted a document to the federal court. The core message: the Bitfinex exchange, not its individual users, is the “sole victim” of the 2016 theft.
This means that individual investors who lost Bitcoin directly in the 2016 hack have no legal claim for compensation. About 94,636 Bitcoins (currently 30% of the US strategic Bitcoin reserve, worth approximately $6.4 billion at today’s market prices) will be ordered to be returned to Bitfinex.
To understand this ruling and its market implications, let’s first revisit the night of August 2, 2016.
That night, 2,072 transactions
Late on August 2, 2016, Bitfinex’s system recorded a series of abnormal withdrawal requests.
These requests appeared fully compliant: each was authorized through multi-signature processes, each carried valid operation credentials. The problem was, all 2,072 transactions (totaling 119,754 Bitcoins) pointed to the same external wallet address.
The core of the attack involved Bitfinex’s multi-signature setup. Bitfinex used BitGo as a third-party custodian, where each withdrawal required simultaneous approval from both Bitfinex and BitGo. The hacker found a backdoor: by exploiting admin privileges in Bitfinex’s backend system, they bypassed BitGo’s approval step, making the system believe each withdrawal was fully authorized by both parties.
In simple terms, the hacker found a key that allowed them to impersonate both the exchange and the custodian, then emptied the vault.
The final step was deleting access credentials and logs from the server, cutting off the most direct trail.
When Bitfinex detected the anomaly, 119,754 Bitcoins had already vanished.
Subsequently, Bitfinex implemented a forced reduction of about 36% of user balances—meaning each account’s funds were forcibly cut by roughly one-third, replaced with BFX tokens as compensation, later converted into platform tokens LEO. For individual users, this was a collective burden-sharing and nearly a decade-long legal saga.
Six years in stealth
Converting 119,754 Bitcoins is not easy. Large-scale selling would leave traceable on-chain clues, so the hacker chose patience (a couple in Manhattan admitted guilt in 2023).
Starting in early 2017, small amounts of stolen Bitcoin began moving. The path was: Bitfinex’s stolen wallet → dark web marketplace AlphaBay. AlphaBay was then the largest dark web trading platform, offering crypto exchange services—trading one coin for another to break on-chain traceability.
In July 2017, AlphaBay was shut down by FBI and European law enforcement. The hacker rerouted to Russia’s Hydra marketplace.
Meanwhile, some Bitcoins were converted into harder-to-trace forms: gold coins. Later indictments showed the wife of the accused personally buried gold coins at a location known to law enforcement. Some were exchanged for Walmart gift cards, used via her iPhone account at Walmart.
Thus, the couple lived a seemingly normal life in New York for six years… Their disguise was nearly seamless.
The ledger remembers
On February 8, 2022, the FBI arrested Ilya Lichtenstein and his wife Heather Morgan in their New York apartment.
Law enforcement found private keys to encrypted wallets containing over 94,000 Bitcoins. At 2022 market prices, this stash was worth about $4.5 billion—over 60 times the value at the time of theft six years earlier.
How did the FBI track them down?
The key was on-chain analysis. Companies like Chainalysis traced every movement of the stolen Bitcoin from the Bitfinex wallet. Despite Lichtenstein’s use of multiple mixing techniques to obscure the trail, Bitcoin’s entire transaction history is permanently recorded on the chain and cannot be erased. Every “cleaning” operation left behavioral patterns at different nodes that could be analyzed.
- In August 2023, Lichtenstein pleaded guilty, admitting he was the attacker in 2016.
- In November 2024, the federal court sentenced him to 60 months (5 years) in prison; Morgan received 18 months.
On January 2, 2026, Lichtenstein was released after serving 14 months, transitioning to house arrest. Under the First Step Act signed by Trump in 2018, non-violent offenders can earn early release through education and vocational programs. Since Lichtenstein’s charges involved money laundering conspiracy—not violence—he qualified.
After release, he publicly thanked Trump on social media; his wife was also released after serving her sentence. The details of their plea agreement with prosecutors remain undisclosed, explaining the leniency.
The US Treasury’s unexpected asset
At the time of arrest, 94,643 Bitcoins were seized by the US government. Further investigations recovered more, totaling over 119,000 Bitcoins, worth over $8 billion today.
Within the government’s custody accounts, these coins remain in limbo: both criminal proceeds and assets pending legal disposition.
In 2025, the Trump administration announced the creation of the “US Strategic Bitcoin Reserve,” consolidating the Bitcoins seized through law enforcement—no longer auctioned or liquidated. The 94,636 stolen Bitcoins from Bitfinex account for 30% of this reserve.
This creates a structural legal contradiction: these coins are criminal assets in a criminal context, yet legally they remain assets to be disposed of by court order.
On January 15, 2026, the DOJ’s answer was: these coins will be returned to Bitfinex.
Individual users, who will compensate?
A hidden aspect in the legal documents is rarely acknowledged explicitly.
The DOJ’s statement claims “there are no victims”: legally, since Bitfinex compensated individual users afterward (via BFX tokens, later LEO), individual claims are no longer valid.
This position has some legal logic: Bitfinex, as an institution, absorbed the loss, and individual account losses have been transferred and compensated.
But practically, those individual users who had one-third of their accounts forcibly deducted in 2016—especially those who didn’t hold LEO tokens long-term or sold during low LEO prices—never truly recovered equivalent compensation.
And if we consider today’s Bitcoin prices, the 36% forced reduction in 2016 meant significant losses.
“The court says Bitfinex is the only victim. But for those whose accounts were forcibly deducted in 2016, that conclusion and what actually happened to them are two different things,”
wrote a long-term Bitfinex user on social media.
The birth of LEO compensation tokens
A quick note: in 2019, Bitfinex’s parent company, iFinex, faced legal issues related to Tether (NY Attorney General accused Bitfinex of misusing Tether reserves to cover an $850 million shortfall). To raise funds, iFinex issued UNUS SED LEO (LEO) tokens through private placement, raising about $1 billion.
LEO’s buyback and burn mechanism
The white paper specifies two burn mechanisms:
- Regular buyback and burn: iFinex commits to repurchasing and burning at least 27% of monthly revenue until all tokens are destroyed, making LEO a deflationary token.
- Recovery of stolen funds: if Bitfinex recovers funds from the 2016 hack (minus legal and operational costs), at least 80% of the net recovered amount will be used to buy back and burn LEO. This clause directly links recovered stolen Bitcoin to LEO holders’ interests.
Three possible outcomes and one market
Currently, three scenarios are possible:
First: All 94,636 Bitcoins are returned to Bitfinex. Bitfinex will fulfill its 2019 promise, using 80% of the recovered funds to buy back and burn LEO. About 75,000 Bitcoins will be gradually released via market purchases, averaging 139 per day over 18 months.
This may have limited impact on overall Bitcoin supply, but LEO could benefit significantly. This is the main expectation reflected in the current 60% premium on LEO.
Second: Partial return, with more complex procedures. If third-party claims are accepted by courts, distribution will involve complex negotiations, possibly extending over years. LEO’s premium may diminish gradually, and the market may turn cautious.
Third: The US government retains the coins. If courts determine these assets are proceeds of crime and not subject to return to victims, the 94,636 Bitcoins stay in the US strategic reserve. The 2019 promise to compensate individual users becomes void, premiums vanish, and claims are effectively closed.
The current trend favors the first scenario, but legal processes rarely move as quickly as market expectations. Will this impact prices? Only time will tell.
