Bitfinex

Documented events with consequences still open. Each entry carries a source and a date.

1. Aug 2, 2016 Hack / funds theft Critical $72M ● open

   119,756 bitcoin taken by bypassing BitGo multisig: Bitfinex pushed the loss onto ALL accounts with a 36% haircut, including those untouched. Users were compensated in tokens within eight months; the bitcoin seized by the United States in 2022 has still not come back

   On **2 August 2016**, **119,756 bitcoin** left Bitfinex, then based in Hong Kong: about **72 million dollars** at the time, down to ~58 million within hours because the news knocked roughly 20% off the bitcoin price. The detail that makes this an industry lesson: the exchange was using **BitGo's multisignature** setup, and it did not help — around **2,000 duly approved transactions** were diverted to a single wallet. Bitfinex halted withdrawals and trading. **The decision that set a precedent, a bad one: the loss was socialised.** It was not borne by the accounts that were hit: **every customer, including those who had not lost a satoshi, had 36% cut from their balance**, receiving in exchange **BFX tokens** proportional to the haircut, convertible into shares of **iFinex** (the parent company) or redeemable. On that front Bitfinex closed the matter: **all BFX tokens were redeemed within eight months** of the plan starting, which is why the users of the time count as compensated — but they were compensated with a financial instrument issued by the same company, not with their bitcoin. **The legal aftermath, still open.** In **February 2022** US authorities arrested **Ilya Lichtenstein** and **Heather Morgan** and recovered bitcoin worth, at the time, **3.6 billion dollars**, by getting into encrypted cloud storage holding addresses and private keys; the funds had moved from AlphaBay to the Russian marketplace Hydra from early 2017. **August 2023**: Lichtenstein admitted carrying out the hack and pleaded guilty to money laundering conspiracy; Morgan pleaded guilty to money laundering and conspiracy. **November 2024**: sentenced to **60 and 18 months** respectively. ⚠️ **And this is why `risolto` is `false` a decade on.** The recovered bitcoin **has not returned to Bitfinex**. In **March 2025** the Department of Justice *recommended* returning over **100,000 bitcoin**, but the US administration's strategic bitcoin reserve initiative created competing claims over seized assets; in **July 2023** holders of **Recovery Right Tokens** were paid roughly **315,000 dollars**, a tiny fraction. A recommendation is not a restitution, and `in_corso` is `false` because nothing is moving right now: the case is **open**, not an emergency. `importo_usd` carries the valuation at the time of the theft (72 million); the same bitcoin is worth orders of magnitude more today, which is why the 2022 seizure figure (3.6 billion) must not be confused with the loss.

   ↗ source

verified on Oct 2, 2026

Weighted average across 3 public review platforms (4,264 reviews in total), weighted by volume. This is not our rating: it is those platforms’ average.