A watershed in Bitcoin crime with an unlikely couple in the glare

In the strange and sometimes shadowy world of cryptocurrency, it was as if the earth shook. In the years since the Bitfinex hacking, crypto had exploded into the mainstream, and the theft had become notorious: a bounty worth more than $4 billion. At last, it seemed, the hackers had emerged from hiding.

But it was not the hackers who had moved the stolen Bitcoin. It was the government, which had seized it as part of an investigation into two New York City entrepreneurs: one a little-known Russian émigré and tech investor; the other, his wife, an American businesswoman and would-be social media influencer with an alter ego as a satirical rapper named Razzlekhan.

Charged with conspiring to launder billions of dollars in Bitcoin, the couple, Ilya Lichtenstein, 34, and Heather Morgan, 31, were accused of siphoning off chunks of the purloined currency and trying to hide it in a complex network of digital wallets and internet personas. If convicted of that and a second conspiracy count, they could face up to 25 years in prison.

The arrests shocked some acquaintances of the couple, whose goofy online lives appeared at odds with prosecutors’ description of them as sophisticated criminals with stacks of foreign currency, multiple fake identities and dozens of encrypted devices stashed in their New York apartment. As they awaited a Monday court hearing in Washington on whether they should be freed on bail, Lichtenstein and Morgan remained the subject of a confounding question: Could they really be at the center of one of cryptocurrency’s enduring mysteries?

Morgan was a regular contributor to Forbes and Inc., writing columns that advised her fellow entrepreneurs on how to protect their digital currency and recommending rapping as a form of self-care, as she did through her alter ego, Razzlekhan (Genghis Khan, but with more pizazz, her website says).

Those who know Morgan said her social media stunts were part of an elaborate act to confront social pressures.

“She works to free herself from a lot of the scripts that are embedded in our society,” said Morgan Brittni Sonnenfeld, who said she is Morgan’s cousin. “I admire her for that; she has a lot of strength.” Sonnenfeld acknowledged that news coverage of Morgan had made her “sound a bit crazy,” and she wondered whether Morgan’s persona may have drawn authorities to her.

“I wonder, why do they want people looking at her? Who are we not looking at? Why are they choosing this specific person?” Sonnenfeld said.

The arrests also surprised Morgan’s friends, who described her as a disarmingly honest colleague in an industry defined by cutthroat competition.

“It is very jarring to think someone so open and vulnerable with people would have secrets,” said one friend, Nora Poggi. “She is someone I care a lot about.”

In court records, the Justice Department describes the trail that it says led investigators to Lichtenstein and Morgan.

In January 2017, five months after hackers hit Bitfinex, a portion of what they stole was moved in small, complex transactions into accounts that the couple controlled, according to a criminal complaint filed in federal court in Washington.

“This shuffling, which created a voluminous number of transactions, appeared to be designed to conceal the path of the stolen” Bitcoin, the complaint says.

Lichtenstein and Morgan were budding tech entrepreneurs at the time. Lichtenstein specialized in cryptocurrency and coding, according to his LinkedIn profile, and Morgan had returned from the Middle East, where she focused on currency markets.

Anirudh Bansal, the couple’s lawyer, declined a request for comment. But in court papers, he has made it clear that he believes the government’s case is weak and relies on “unsupported, conclusory leaps.”

Beyond Morgan’s highly public persona, little is known about the couple. They have been together for seven years and married for three, Bansal told a federal magistrate judge in New York on Tuesday during arguments over whether the couple should be released on bail.

In saying that his clients were not a risk to flee, Bansal offered some personal details about them.

Lichtenstein, Bansal said, came to the United States from Russia when he was 6. His father works for the housing authority of Cook County, Illinois, and his mother is a biochemist at Northwestern University.

Morgan, who was born in Oregon, runs a consulting firm that employs up to 30 freelance writers at a time, Bansal said. Her father served in the U.S. military and is a retired biologist. Her mother is a high school librarian.

Lichtenstein’s family had immigrated to the United States to flee religious persecution, and there was “no chance” he would return to Russia, Bansal said.

In a later letter, another of the couple’s lawyers wrote that Morgan had frozen several of her embryos at a hospital in New York in anticipation of starting a family.

“The couple would never flee from the country at the risk of losing access to their ability to have children,” the lawyer wrote.

At the hearing, a prosecutor, Margaret Lynaugh, said in opposing bail for Lichtenstein, a dual citizen of the U.S. and Russia, that he had an active Russian passport and the means and intent to flee.

The judge ordered that the couple be freed on multimillion-dollar bonds, but at the government’s request, a federal judge in Washington blocked their release and scheduled the hearing Monday.

In court papers, the government has called Lichtenstein and Morgan “highly sophisticated criminals.” Prosecutors said they believed the couple had significant additional assets, including hundreds of millions of dollars in virtual currency stolen from the Bitfinex exchange that had not been recovered, as well as access to numerous fraudulent identities bought on the so-called darknet, a hidden portion of the internet used for illicit transactions.

The government says the couple had also established financial accounts in Russia and Ukraine and appeared to have been setting up a contingency plan for a life in one of those countries before the pandemic.

As evidence of what they depicted as a complicated money laundering scheme, prosecutors say in a court filing that they had traced stolen cryptocurrency to more than a dozen accounts held in the true names of the couple or their businesses.

The government says in the court filing that when agents executed a search warrant at the couple’s New York apartment Jan. 5, they recovered more than 50 electronic devices, including a bag labeled “burner phone,” and more than $40,000 in cash. Many of the devices were partially or fully encrypted or otherwise password-protected, the court filing says.

In Lichtenstein’s office, agents found two hollowed-out books whose pages appeared to have been cut out by hand to create secret compartments, the filing says. (The compartments were empty.)

And then there was the couple’s cat.

As agents were about to begin the search, Morgan and Lichtenstein said they would leave their apartment but wanted to take their cat, the filing says. The agents allowed Morgan to retrieve the cat, which was hiding under the bed.

But as Morgan crouched by the bed and called to the cat, she positioned herself next to a nightstand that held one of her cellphones, the filing says. She then reached up, grabbed the phone and repeatedly hit the lock button in what prosecutors say was an apparent effort to make it harder for investigators to search the phone’s contents.

The agents had to wrest the phone from Morgan’s hands. Court records provided no further information about the cat.