Bitfinex: The Theft That Blockchain Didn't Forget

Bitfinex used a multi-signature solution for customer funds in cooperation with BitGo. The goal was to reduce the risk that one compromised key would be enough for a withdrawal. On August 2, however, the system authorized a large series of transactions that the exchange did not want to perform. The formal number of signatures did not prevent the failure of the entire operational arrangement.

Exactly 119,754 BTC were stolen in more than 2,000 transfers. At the time, it was about $70 million; later growth in the exchange rate made it billions. For users, however, the damage did not start with the future graph. It started the moment the service stopped operating and their balances became part of the solution to someone else's security incident.

The theft showed the difference between multi-sig technique and multi-sig management. More keys only help if they are independent, the signing rules reveal an unusual request, and the system does not have a path that bypasses protection. A security scheme cannot be evaluated by the number of keys without knowledge of who and under what conditions uses them.

Additionally, the exchange customer could not distinguish their share from others on-chain. In the internal database, they had an accounting balance; private keys were controlled by the service. The counterparty risk materialized precisely when the technical problem of the wallet turned into a decision on how to divide the loss among people whose individual accounts were not attacked.

Bitfinex published ongoing information, but initially could not explain the full mechanism of the breach. Such uncertainty is common and painful in an incident: users need to know if the remaining funds are safe, while the investigation cannot immediately publish all leads. The exchange decided to resume operations with an accounting loss after just a few days.

Bitfinex did not assign the loss only to the bitcoin accounts from which the coins had been taken. It announced a 36.067 percent reduction across customer balances. In its announcement at the time, the exchange said this was the closest approximation to what would happen in a liquidation. The consequences of a technical failure were thus shared among customers through a common accounting arrangement.

For the written-off value, the exchange issued BFX tokens in dollar nominal value. The holder could trade them, have them later redeemed, or converted into a share in the parent company iFinex. The construction gave the affected parties a liquid claim, but at the same time transferred the risk to them whether the exchange would survive and be able to fulfill the obligation.

By April 2017, Bitfinex announced that it had redeemed all BFX tokens for their nominal dollar value or converted them into shares. The claim of full compensation must therefore be read precisely. The user did not get back the original number of bitcoins, whose price could have risen in the meantime; they got the value according to the mechanism introduced by the company after the incident.

Some customers sold the token earlier at a discount, others held it, and others chose shares. Their economic experience differed. The company's statement about redeeming all tokens describes the closure of the obligation according to BFX rules, not a uniform return to the state before the theft.

The case became a significant argument for self-custody. However, even that does not guarantee safety without proper backups and procedures. The difference is in the place of decision-making: with one's own wallet, a person bears the risk of the key directly, while on the exchange, they entrust the key and the crisis plan to the company, which can change their accounting claim after a loss.

A flat percentage for everyone looked simple on the books, but the human situations were not. One customer held bitcoin on the exchange, another a dollar balance, and yet another an open trading position. The distribution of the loss therefore immediately raised the question of whether the firm could convert different assets into a common debt claim after the failure. The BFX token gave this claim a tradable form, not a guarantee that everyone would get back the same thing economically. When Bitfinex later redeemed it at a nominal dollar value, it could truthfully say that it had settled the obligation; the customer could still compare the outcome with the amount of bitcoin that had been written off. Both statements can be true at the same time.

The stolen bitcoins remained on addresses that any analyst could track after the theft. The public saw when part of the stock moved, but the transaction graph itself did not contain the perpetrator's name. An address is a pseudonym, not an ID card, and one person can create thousands of addresses.

According to the US Department of Justice, investigators tracked transfers through complex chains, accounts under false identities, asset exchanges, and services called mixers. Part of the proceeds was used to buy gold, according to court documents. Each additional step was supposed to separate the coins from the known source, but at the same time added new places where a trail could emerge.

Bitcoin mixing can make it difficult to simply assign inputs and outputs, but it does not erase all surrounding data. Exchanges keep login and identification data, cloud services keep records, and seized devices can contain files that link a pseudonymous address to a specific person. Chain analysis was one part of the puzzle, not an automatic revelation.

In February 2022, US authorities announced the arrest of Ilya Lichtenstein and Heather Morgan and the seizure of approximately 95,000 BTC. Access to such a large part of the coins was enabled by private keys found during the investigation. Without keys, knowledge of addresses would not have given the government the ability to move the funds.

The seizure created a new legal problem: who has the right to assets whose number is the same, but the dollar value has changed dramatically? Original customers, the exchange, and other creditors could have different arguments. On-chain ownership in the hands of authorities did not decide on fair distribution; that remained the task of courts and legal processes.

Lichtenstein admitted in 2023 that he hacked Bitfinex and subsequently laundered the stolen funds. Morgan admitted to participating in the laundering of the proceeds. These admissions separated earlier accusations from the judicially confirmed role: it was not just a couple found next to the keys, but people who accepted responsibility for specific actions.

In November 2024, Lichtenstein received a five-year prison sentence. The verdict came eight years after the theft. The long interval shows both sides of the public ledger: investigations can take years, but historical data is not rewritten in the meantime, and an old transfer can be re-analyzed with new information.

The story is often used as evidence that Bitcoin is not anonymous. A more accurate word is pseudonymity. The blockchain permanently shows amounts and relationships between addresses, but identity is added only by connection to the outside world. If a person does not make any connection, the name in the chain is not. If they do, it can also illuminate years-old history.

Blockchain analysis is therefore not an all-seeing camera. It works with probabilities, patterns, and data from institutions. In the Bitfinex case, court orders, exchange records, cloud data, and a seized file with keys were added to public transactions. It was only the sum that allowed the transition from the graph to people and from tracking to seizure.

The Bitfinex hack connects three different stories that need to be kept separate: the failure of the custodial service in 2016, the company's division and compensation of the loss, and the later criminal investigation into money laundering. The blockchain linked all parts with a permanent trail, but did not resolve any of them on its own. It did not forget transactions; people had to find out what they meant and who was responsible after years.

The case therefore resists the simple lesson that a public blockchain either guarantees full anonymity or, on the contrary, exposes everyone. Addresses are visible; no names are written in them. The investigation gained meaning only through linking on-chain movements to service accounts, documents, devices, and ultimately the keys that enabled the coins to be moved. Each additional step could strengthen or refute the hypothesis. Chain tracking was a map, not a verdict. It is precisely this slowness that explains the six-year gap between the theft and the major seizure: the trail remained, but converting it into an identity and evidence required work outside the blockchain and procedures that must hold up in court.