From public reporting. This is a real case, not Chainsentra's own work. It's included to show how blockchain intelligence — the same kind of tracing Chainsentra does — supports real investigations. Outcomes vary by case.
In August 2016, the cryptocurrency exchange Bitfinex was hacked, and roughly 119,754 to 120,000 bitcoin was stolen — at the time, one of the largest thefts in the industry's history. For almost six years, the stolen funds sat, moved, and were tracked across the blockchain's public ledger. Then, on February 8, 2022, the US Department of Justice announced it had seized more than 94,000 bitcoin, valued at roughly $3.6 billion at the time, and arrested a married couple, Ilya Lichtenstein and Heather Morgan, in New York.
How do you trace a theft from six years earlier?
The key fact that makes this case possible at all is one explained in blockchain basics: a public blockchain's record doesn't expire or get overwritten. Every transaction the stolen bitcoin made since 2016 — however many hops, however long the gaps between movements — remained permanently visible on the ledger.
According to reporting on the case, investigators built an analysis graph, described as a Chainalysis Reactor graph, tracing the stolen funds' movements from the original 2016 theft forward. Chainalysis itself has said that the permanence of the blockchain record contributed significantly to the eventual recovery of the assets.
From a trace to an actual seizure
Tracing where the bitcoin had gone was necessary but not sufficient. The hop-by-hop record showed where the funds were; it didn't by itself let anyone move them. That required a separate step: a warrant for online accounts controlled by Lichtenstein, which yielded the private keys needed to actually access and transfer the bitcoin into government custody.
| Step | What it provided |
|---|---|
| On-chain tracing | Showed where the stolen bitcoin had moved since 2016 |
| Account investigation | Identified accounts controlled by the suspects |
| Search warrant | Authorised access to those accounts |
| Private keys recovered | Allowed the government to actually move the bitcoin |
| Arrests and charges | Lichtenstein and Morgan charged with money-laundering conspiracy |
That sequence — trace, identify, obtain legal authority, then act — is the same structure behind most successful crypto seizures, just compressed into days or weeks in smaller cases rather than years.
What about the hack itself?
Lichtenstein and Morgan's initial 2022 charges covered laundering the stolen funds, not the 2016 hack itself. Later court filings, around their 2023 guilty pleas, included an admission from Lichtenstein that he had also orchestrated the original theft. Reporting also describes further, smaller recoveries of Bitfinex-linked bitcoin in the months following the February 2022 seizure, as investigators continued working through the case.
What this case shows about patience and permanence
It would be easy to read this case as proof that stolen crypto always gets traced eventually. It doesn't show that — plenty of thefts are never resolved, and nothing about this case was certain in advance. What it does show is narrower and more useful: the data an investigation needs doesn't degrade over time the way some other kinds of evidence can. A transaction hash from 2016 was exactly as usable in 2022 as it was the day the transaction happened.
That has a direct, practical implication for anyone who's lost crypto more recently: the records you keep now — addresses, hashes, dates, screenshots — remain useful whenever an investigation can be completed, whether that's in weeks or, in rare cases like this one, years later.
What this means if you've lost crypto
Chainsentra's investigations use the same underlying method shown in this case — following the public record hop by hop and documenting what it shows — though almost every individual case resolves on a far shorter timeline than six years. An investigation produces a trace and an evidence report; what a prosecutor, court or exchange then does with that evidence is their decision, and no particular outcome, timeline or amount recovered is ever promised.
If you've lost crypto, a free assessment reviews what you've shared and tells you honestly whether a trace is likely to go anywhere, based on what's actually on the public ledger today.
Key takeaways
- The 2016 Bitfinex hack was traced using the public blockchain record nearly six years after the theft, leading to a 2022 seizure of more than 94,000 bitcoin.
- A public blockchain's transaction record is permanent; it doesn't expire or degrade over time.
- Tracing where funds went and actually seizing them are two different steps — the second required a warrant and recovered private keys.
- Keeping your own transaction records means the evidence an investigation needs stays usable, however long a trace takes.
Further reading
- Blockchain basics
- How tracing works
- The Ronin Bridge theft and the Lazarus Group link
- Start a free assessment
Sources: US Department of Justice, US Department of Justice, US Attorney's Office, D.C., The Block.