biggest

When $72 million worth of bitcoin was stolen from Bitfinex, a Hong Kong-based virtual cryptocurrency exchange, it was the second-largest hack of its kind. The 2016 theft sent the entire crypto ecosystem into a tailspin and the value of bitcoin fell about 20% within hours. Bitfinex customers, some of whom had invested their life savings in bitcoin, lost thousands of dollars overnight. Over the next five years, the initial hacked sum grew in value—to approximately $4.5 billion (now it’s worth $10.8 billion.)

But unlike other bitcoin heists, these hackers didn’t get away with it. Five years after the theft, the FBI arrested married couple Heather “Razzlekhan” Morgan and Ilya “Dutch” Lichtenstein, whom the Justice Department accused of conspiring to launder $4.5 billion in stolen bitcoin. News of the arrest immediately went viral, not only due to the sky-high amount of money involved, but also because of the perplexing ways Morgan and Lichtenstein documented their lives online. In 2019, Morgan adopted a rap persona called Razzlekhan (“like Genghis Khan, but with more pizzazz,” she wrote on her website) and filmed hundreds of cringe-inducing YouTube videos with crypto-themed raps.

Netflix captures the saga of Dutch and Razzlekhan in Biggest Heist Ever, a new documentary airing Dec. 6. Directed by Chris Smith (Bad Vegan, Fyre) and featuring interviews with investigators, former cyber criminals, and former friends of the couple, Biggest Heist Ever examines the initial Bitfinex hack and works to better understand Morgan and Lichtenstein, or, as they’ve come to be known, “Bitcoin Bonnie and Clyde.” The documentary also raises new questions about the hack, suggesting possible issues about national security and Lichtenstein’s ties to Russia. 

Let’s break down the true story behind Biggest Heist Ever and examine the story’s unresolved threads. 

Who are Heather Morgan and Ilya Lichtenstein?

Heather Morgan is a 34-year-old entrepreneur and aspiring rapper. Originally from Chico, California, Morgan graduated from University of California, Davis in 2011 with a bachelor’s degree in economics and international relations. According to her LinkedIn profile, she also received a master’s degree in economics of international development at American University of Cairo.  

After graduation, Morgan worked in Silicon Valley at a startup called Tamatem, later meeting Lichtenstein at a tech conference. The pair moved to a condo in New York, and Morgan pursued multiple projects, including writing articles for Inc. and Forbes and founding a copywriting and email marketing agency called SalesFolk. In addition to pursuing a rap career as Razzlekhan, Morgan promoted herself as an entrepreneur-influencer; her Instagram bio still reads: “I make the weird kids feel at home. ‍♀️ Surrealist artist, rapper @Razzlekhan & tech entrepreneur with synesthesia.”

Meanwhile, Lichtenstein, 35, who goes by the nickname “Dutch” (a character from the video game Red Dead Redemption 2) and is from Glenview, Illinois, comes from a family that emigrated from Russia. At the time of his arrest, his LinkedIn profile described Lichtensetin as a “technology entrepreneur, coder and investor” who is “interested in blockchain technology, automation, and big data.” Lichtenstein graduated from the University of Wisconsin-Madison with a bachelor’s degree in psychology.

Lichtenstein co-founded a startup called MixRank (“a spy tool for contextual and display ads,” according to its website) but exited the company near the end of 2016. The following year, he and Morgan moved to New York.”  

Who (or what) is Razzlekhan?

Razzlekhan is Morgan’s self-appointed rap name. In a 2019 video, Morgan explains she created the alter-ego, inspired by real-life rapper/actress Awkwafina, after dealing with a bout of professional burnout. “I think I was pretty unhappy … I think I was searching for something more.”

Nick Bilton, who wrote a 2022 piece about the couple for Vanity Fair, tells filmmakers: “If you’re Ilya and Heather and you have this money, you’re probably kind of terrified of being caught. People deal with anxiety and stress and tension differently. Some people start having panic attacks. Some people start obsessively exercising. It’s steam going through you that has to come out some way. I think for Heather, the creation of Razzlekhan and the rapping was the steam valve.”

Razzlekhan’s much-mocked music video for “Versace Bedouin” didn’t make an impression when it was first posted to YouTube in 2019, but it went viral three years later, after news broke of the couple’s arrest.

What new information does Biggest Heist Ever uncover? 

In addition to tracing a timeline from the 2016 Bitfinex hack to the present day and describing how federal authorities discovered Morgan and Lichtenstein’s involvement, Biggest Heist Ever raises a new series of questions about the hack and its implications. In particular, the documentary suggests that Lichtenstein may have been inspired to commit the Bitfinex hack by his father, Eugene, who hacked into the First National Bank of Indiana, as well as a Secret Service computer, many years earlier. 

As the doc lays out, Eugene (under a hacker name “Deuce”) approached a government informant and former cybercriminal named Brett Johnson, who tells filmmakers Eugene asked him how to “cash out” what he’d hacked from the bank. In 2005, the Secret Service flew to Chicago to question Eugene about hacking into their computer, as well as the Indiana Bank hack. Eugene, who admitted to the Indiana Bank hack and agreed to cooperate with the Secret Service as an informant, was never charged with any wrongdoing. Eugene Lichtenstein later became a Chicago real estate agent. He did not respond to requests to participate in the film.

Biggest Heist Ever explains that Eugene’s former hacker name was Manus Dei (which he shortened to Deuce) or “Hand Of God” in Latin, while Lichtenstein operated under the name Deus Machina, shortened to Deus, which translates to “God Machine.”

“I believe Ilya is trying to pay some sort of respect or homage to Daddy,” says Johnson in the film. “The father being the hand of God, the son being the machine of God. In my opinion, the Bitfinex hack is awfully similar to what Eugene did way the hell back in 2005 when he compromised the First National Bank of Indiana.” 

How were Lichtenstein and Morgan caught?

The couple used a darknet market called AlphaBay to move the stolen cryptocurrency to different wallets and accounts. “After being moved into accounts at AlphaBay, the stolen BTC was withdrawn, layered, and ultimately deposited into [virtual currency exchanges] around the world,” reads a 20-page statement given to the IRS by special agent Christopher Janczewski, who was interviewed for the film. 

The FBI seized AlphaBay servers in 2017 and shut down the website. Those servers provided data leading investigators to Lichtenstein and Morgan. 

In January 2022, law enforcement obtained a search warrant for the couple’s Wall Street apartment and electronic devices. In the apartment, they found currencies from other countries, hollowed-out books, and a bag of burner phones actually labeled “burner phones.”

The feds also discovered an encrypted spreadsheet containing a list of 2,000 virtual currency addresses and corresponding private keys linked to the hack and leading to the stolen funds. Lichtenstein and Morgan were arrested in February 2022. 

What were the couple charged with?

Lichtenstein and Morgan were charged with conspiring to launder the stolen bitcoin. (Neither Lichtenstein nor Morgan were accused of perpetrating the actual hack. “It’s potentially more difficult to prove the hack,” Ari Redbord, the head of legal and government affairs at crypto regulatory startup TRM Labs, told TIME in 2022.)

Following his arrest, Lichtenstein was not permitted to leave jail, as the courts perceived him to be a flight risk. (Lichtenstein has a Russian passport, and the couple had traveled extensively to Ukraine the year prior, leading prosecutors to believe that they intended to start a new life overseas.) Morgan was allowed out on bail and permitted to work from home. 

At their plea hearing in August 2023, Lichtenstein admitted to the hack, telling the court he had access to the Bitfinex infrastructure. He admitted to stealing usernames and passwords and that he operated alone. At a certain point, however, he said Morgan became involved in the laundering process. 

Morgan said she didn’t know what was going on at first but eventually realized the source of Lichtenstein’s bitcoin was a theft. She then took steps to help launder the proceeds. Morgan also admitted to destroying some evidence (she admitted to throwing a laptop down a trash chute and burying gold coins; they were recovered by the government).

Lichtenstein cooperated with the FBI and led them to the rest of the missing crypto. He was offered an opportunity to enter the witness protection program as part of a plea agreement, which he accepted. It’s not known why witness protection is part of the deal, but in November 2022, prosecutors filed documents alleging that the ongoing investigation was now a matter of national security. The filing didn’t specify why. 

On Nov 14, 2024, Lichtenstein was sentenced to five years plus three years of supervised release. At his sentencing, Lichtenstein expressed regret for “wasting my talents on crime instead of a positive contribution to society… I want to take full responsibility for my actions and make amends any way I can.” He did not respond to a request to answer further questions, but in May 2022 he did provide a statement to doc director Chris Smith: 

Chris, thank you for your kind note. As you mentioned, I am unable to discuss the case at this time. I look forward to sharing my perspective when the time is right. As your instincts probably tell you, there is more to this story than meets the eye. Best of luck with your film.

On Nov. 18, Heather was sentenced to 18 months and three years of supervised release. She declined to participate in Biggest Heist Ever. In a video posted to X, Morgan said: “It’s over, and I’m very excited that I will soon be telling my story, sharing my thoughts, and telling you more about the creative and other endeavors I’ve been working on.”