A cringe rapper slash Forbes contributor allegedly found with billions in stolen Bitcoin

Heather Morgan, who was arrested along with her husband, performed under the name “Razzlekhan.” | Image: Razzlekhan

The Department of Justice has finally found almost all of the billions worth of Bitcoin stolen during the 2016 hack of cryptocurrency exchange Bitfinex — in the hands of a published Forbes and Inc. writer and rapper, who calls herself the “Crocodile of Wall Street,” and her startup founder husband.

The DOJ says it seized about $3.6 billion worth of the cryptocurrency, allegedly held by Heather Morgan and her husband, Ilya Lichtenstein. The couple is accused of trying to cover their tracks by laundering the stolen funds through “a labyrinth of cryptocurrency transactions.” It’s the department’s “largest financial seizure ever,” according to a Tuesday press release.

The DOJ doesn’t explicitly say they stole the billions in cryptocurrency — an unnamed hacker was the one who transferred 119,754 Bitcoin from the exchange to an outside wallet, and that wallet was allegedly controlled by Lichtenstein. But considering the total amount stolen during the breach was 119,756 Bitcoin, that suggests Lichenstein and his partner had access to nearly the entire sum stolen from Bitfinex.

And according to the statement of facts prepared by an IRS special agent (PDF), the value of those Bitcoin has ballooned significantly since the hack — in 2016, they were worth $71 million, and now, their value is measured in billions.

Morgan has instantly become a character following news of the hack today, as people have been combing through her social media and LinkedIn and discovering her… unique persona. The DOJ’s criminal complaint lists an alias of hers as “Razzlekhan,” and people were quick to discover the rap songs she released under that name. The music video for one of the songs is titled “Rap Anthem for Misfits & Weirdos: Versace Bedouin Music Video,” and Razzlekhan shouts out “entrepreneurs and hackers” in the lyrics.

Morgan’s also done a considerable amount of writing at Inc. and Forbes, and her author profile says that “when she’s not reverse-engineering black markets to think of better ways to combat fraud and cybercrime, she enjoys rapping and designing streetwear fashion.” One of her articles even offers advice on how to keep your business safe from cybercriminals.

While Morgan’s online antics have gotten a lot of the focus, the bulk of the DOJ’s accusations fall on Lichtenstein (though Morgan is still heavily implicated and allegedly gave false information to at least one of the crypto exchanges she held Bitcoin in). Lichtenstein’s LinkedIn lists him as the founder of a blockchain startup named Endpass and co-founder of MixRank.

Image: Elliptic
An image from analysis done by Elliptic, tracing the movement of some of the stolen funds.

Since the hack, the crypto industry has kept a close eye on the stolen coins’ movement. Crypto compliance firm Elliptic has a great deep-dive from 2021, which covers how hundreds of thousands of dollars worth of Bitcoin were shuffled around, though, at the time, it was unknown who controlled the wallet. The government alleges that Lichtenstein and Morgan’s laundering involved several other crypto exchanges and gift cards for Walmart, Uber, Hotels.com, and PlayStation. The statement of facts also accuses the couple of lying to exchanges about how they got the Bitcoin and what they were doing with it.

Law enforcement says it was able to seize the 94,636 Bitcoin left in the wallet because Lichtenstein allegedly uploaded a list to a cloud storage and email provider that contained addresses for the wallet that Binfinex’s funds were dumped into, along with the private keys to access them. The file was encrypted, but after obtaining it through a search warrant, the statement of facts says that law enforcement was able to decrypt it and several other files (though it doesn’t offer any explanation of how).

This let the government seize the 94,636 Bitcoin left in the wallet and also gave it access to other potentially incriminating documents, like a spreadsheet showing other accounts linked to the stolen funds and a list of dark web sites that sold passports and IDs.

The DOJ will let people who lost Bitcoin in the hack request that the government return it to them, according to CNBC correspondent Eamon Javers. Javers also notes that the couple is accused of using some of the funds to purchase NFTs but says the DOJ wouldn’t say whether they’d purchased any Bored Apes.