Bitfinex Hack Explained: The 2016 Theft and the Recovery

By Owen Thurm Published November 6, 2026 6 min read

Quick answer. In August 2016, a hacker inside Bitfinex's network moved about 119,754 BTC from its BitGo multisig wallets. In 2022, agents seized about 94,636 BTC with keys from Ilya Lichtenstein's cloud storage; prosecutors then sought their return to Bitfinex.

Watch: Bitfinex Hack Explained: The 2016 Theft and the Recovery 1:39

Video transcript

In 2016, a hacker inside Bitfinex's network drained about 119,754 bitcoin from multisig wallets built to prevent exactly that.

Those coins were worth about 71 million dollars then, and over 4.5 billion dollars by February 2022.

Bitfinex had moved from one pooled wallet to BitGo multisig wallets, one per trader. But per the CFTC order, Bitfinex still controlled the private keys.

Bitfinex said its withdrawal limits were somehow bypassed. BitGo found no evidence of a breach of its servers. The government says the hacker sent over 2,000 transactions from inside Bitfinex. How the limits failed is still not public.

Most coins never moved. In 2022, agents found private keys in Ilya Lichtenstein's cloud storage and seized about 94,636 bitcoin.

Lichtenstein and his wife, Heather Morgan, pleaded guilty to money laundering conspiracy. In 2025, prosecutors asked to return the coins to Bitfinex. That return is still unconfirmed.

A co-signer is only as independent as its policy. If the systems it protects can change that policy, one breach can satisfy every signature.

So keep limits with the co-signer, off the hot path. Make policy changes slow. Cap total outflow, halt signing on anomalies, keep recovery keys offline, and drill it.

Read the full breakdown, or talk to Guardian about putting a real policy behind your co-signer.

The bitcoin taken in the 2016 Bitfinex hack was worth about $71 million then. By February 2022 it was worth over $4.5 billion, per the government's statement of facts.

It is also a multisig story. The coins sat in segregated multisig wallets set up with BitGo, a design meant to be safer than one pooled wallet. They left anyway.

Here is what the court filings, the regulator, both companies and reputable outlets said, with dates. Then come the lessons for anyone who runs multisig custody.

The Multisig Setup

The CFTC's order of June 2, 2016 describes how Bitfinex held customer bitcoin. Bitfinex settled without admitting or denying the findings.

Until August 2015: bought bitcoin sat in one omnibus wallet, with every private key held by Bitfinex.
August 2015: exchange purchases moved to multisig wallets from a third-party firm, one per trader.
January 2016: margin purchases moved to individual multisig wallets too.

For both changes, the order says, Bitfinex "retained control over the private keys". The CFTC fined Bitfinex $75,000 over illegal off-exchange financed retail trades and a registration failure.

The order does not name the firm. Reuters, via Fortune, and TechCrunch named BitGo, which offered segregated, multi-signature wallets.

TechCrunch called the model "a supposed security improvement over exchanges that merge customers' funds into large, communal wallets."

How the Attacker Got Through

Bitfinex dates the theft to August 2, 2016, in its 2019 LEO white paper.

The government's 2022 statement of facts refers to the exchange as "Victim VCE." It says a hacker "breached Victim VCE's security systems and infiltrated its infrastructure."

While inside the network, the hacker initiated over 2,000 unauthorized transactions. About 119,754 BTC went to one outside wallet.

Bitfinex's own count was 119,756 BTC, about $72 million, per Reuters. Bitcoin's price fell about 20% on the news, TechCrunch reported.

What each side said at the time

Bitfinex, on Reddit: it had "limits in place to restrict the amount of btc that could be signed for a withdraw".
Bitfinex, same comment: it was still investigating how those limits were bypassed.
BitGo: its investigation "has found no evidence of a breach to any BitGo servers."
Zane Tackett, Bitfinex: "The bitcoin was stolen from users' segregated wallets."

The Bitfinex quotes come via TechCrunch; the BitGo and Tackett quotes via Reuters.

What is still open

The public filings we read do not explain how the transactions got past those limits. Neither do the companies' statements in our sources.

So this post assigns no fault. The lessons below hold whichever control failed.

Shared Losses and the BFX Token

Bitfinex did not leave the loss with the wallets that were drained. It allocated the losses across all accounts, per its 2019 white paper.

The cut came to 36% of user balances, per crypto.news.

BFX tokens: credited at 1 BFX per dollar lost.
Redemption: within eight months, every BFX was redeemed at face value or swapped for iFinex shares.
RRT: holders who swapped got Recovery Right Tokens, paid up to $1 each from any recovery.
LEO: iFinex pledged at least 80% of net recovered hack funds to buy back and burn LEO.

That LEO pledge runs for 18 months from the date of any recovery, per the white paper of May 8, 2019.

Arrests, Pleas and the Seizure

Most of the stolen coins never moved. They sat in the original wallet from August 2016 until January 31, 2022, per the statement of facts.

From January 2017, a portion moved out in thousands of small transactions. Agents traced it through AlphaBay, several exchanges and privacy coins to accounts of Lichtenstein and his wife, Heather Morgan.

Then agents decrypted a file in Lichtenstein's cloud storage, obtained under a search warrant. It listed 2,000 addresses "along with corresponding private keys."

With those keys, they seized about 94,636 BTC, then worth $3.629 billion. Our guide on whether stolen crypto can be traced covers that side.

Date	Event	Source
Aug 2, 2016	About 119,754 BTC taken in over 2,000 transactions	Bitfinex, DOJ
Jan 31 to Feb 1, 2022	About 94,636 BTC seized with keys from a cloud file	DOJ statement of facts
Feb 2022	Lichtenstein and Morgan arrested	CNBC
Aug 2023	Both plead guilty to money laundering conspiracy	CNBC
Nov 14, 2024	Lichtenstein sentenced to five years	CNBC
Nov 2024	Morgan sentenced to 18 months	CNBC, CoinDesk
Jan 2025	Prosecutors ask for 94,643 BTC to go back to Bitfinex	CoinDesk, The Block

At the 2023 plea hearing, Lichtenstein first publicly admitted he was the Bitfinex hacker, CNBC reported. His sentence adds three years of supervised release.

The Return to Bitfinex

In January 2025, prosecutors asked the court to return 94,643 BTC to Bitfinex as restitution in-kind, CoinDesk reported. Forked coins such as Bitcoin Cash would go with them.

Their reasoning, per The Block: there is no legal "victim" for the laundering offenses, but the plea agreements let the court order voluntary restitution.

The roughly 25,000 BTC that left the original wallet are harder. Prosecutors said they must go through a separate ancillary forfeiture proceeding.

In March 2026, crypto.news reported that a federal court had ordered the return. It did not name the court or give the order's date.

We could not confirm that order in court records, or that the coins have reached Bitfinex. Treat the return as open.

The Signing-Policy Lessons

A co-signer is only as independent as its policy. If the systems it protects can request, approve or change that policy, one breach can satisfy every signature.

Whatever failed at Bitfinex, these controls address that pattern:

Policy off the hot path: limits and allowlists live with the co-signer, not the exchange servers.
Slow policy changes: raising a limit needs separate approvers and a time delay.
Aggregate caps: cap total outflow per hour across every wallet, not just per withdrawal.
Anomaly halts: a burst of withdrawals stops signing and pages a person.
Mapped key control: record who controls each key, including backups.
Offline recovery keys: keep backup keys off every system that signs routinely.
Drills: test the halt and the policy-change path on a schedule.

Our multisig best practices guide covers later losses, such as Bybit and WazirX, and turns them into a signer policy.

Choosing a provider? Our guide to crypto custody starts with one question: can anyone, including the provider, move assets alone?

How Guardian Helps

For institutions, Guardian advises on custody, signing, chains, bridges and contract design "while they are still decisions."

Its control design covers trust boundaries, privileged roles, approval thresholds and key custody, specified before they are built.

A Guardian OpSec audit maps every path to your funds: where keys live, who holds which share, and what a quorum requires in practice.

Under Managed Security, Guardian's security operations team reviews every multisig transaction before it is signed.

Frequently Asked Questions

How much bitcoin was stolen in the Bitfinex hack?

About 119,754 BTC, per the US government, worth about $71 million in August 2016. Bitfinex's own count was 119,756 BTC. By February 2022, the stolen coins were worth over $4.5 billion.

Who hacked Bitfinex?

Ilya Lichtenstein admitted at his August 2023 plea hearing that he was the hacker, CNBC reported. He and his wife, Heather Morgan, pleaded guilty to money laundering conspiracy. He was sentenced to five years and she to 18 months.

Was BitGo hacked?

BitGo said in August 2016 that its investigation found "no evidence of a breach to any BitGo servers." The government's statement of facts says the hacker initiated the transactions from inside Bitfinex's network.

Did Bitfinex get the bitcoin back?

Agents seized about 94,636 BTC in 2022. In January 2025, prosecutors asked the court to return 94,643 BTC to Bitfinex. A March 2026 crypto.news report says a court ordered it; we could not confirm the order or the transfer.

Sources

Put a real policy behind your co-signer

Guardian maps who controls each key and what your withdrawal limits actually stop, before an attacker tests them.

Talk to Guardian Explore institutional security