Curriculum·J311 Privacy, Surveillance, and Compliance Exposure·about 34 min
You are being watched, and so is everyone
By the end of this lesson you can
- →Distinguish pseudonymity from anonymity, and name the event that converts one into the other
- →Explain why a public ledger improves in resolution over time rather than decaying
- →Compute what a laundering effort has to achieve to succeed, and why the arithmetic runs against it
- →Identify the three linking events that connect an address to a person
Junior · enrolled learners
This lesson opens with The Bitfinex laundering, 2016 to 2022.
- What happened
- In August 2016 Ilya Lichtenstein breached Bitfinex and initiated more than 2,000 unauthorized transactions moving 119,754 BTC, worth roughly $71M at the time, to a wallet he controlled. Over the following years he and Heather Morgan laundered the proceeds through fictitious identities, computer programs that automated transactions so that many could take place in a short time, deposits into accounts at darknet markets including AlphaBay, mixing services including Bitcoin Fog and Wasabi, chain hopping, conversion into Monero, gold coins that Morgan buried and that law enforcement later dug up at a premises in California, and US business accounts used to make the banking activity look legitimate. In February 2022 the Department of Justice seized 94,636 BTC, about $3.6B at the time, which the Deputy Attorney General called the department's largest financial seizure ever. Lichtenstein was sentenced to 60 months on 14 November 2024 and Morgan to 18 months on 18 November 2024.
- The decision point
- This was not a careless effort. It used most of the techniques that exist, layered on top of each other, run by someone technically capable, over more than five years. The record it was hiding in never expired, never degraded and was available to anybody who wanted to work on it, for as long as they wanted. Laundering has to succeed at every technique for the entire remaining life of the record. Analysis has to succeed once.
- Recorded loss
- $3,600,000,000
What you will be able to answer
- →Pseudonymous or anonymous?
- →What converts pseudonymity into identity?
- →Why does the record improve rather than decay?
- →What is the asymmetry?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.trmlabs.com/resources/blog/ilya-lichtenstein-sentenced-for-role-in-bitfinex-hack-in-razzlekhan-case-as-government-recovers-about-10-billion-in-stolen-funds
- https://www.cnbc.com/2024/11/14/bitfinex-hacker-sentenced-to-five-years-in-prison-for-bitcoin-money-laundering-scheme.html
- https://www.ice.gov/news/releases/bitfinex-hacker-sentenced-money-laundering-conspiracy-involving-billions-stolen
- https://www.irs.gov/compliance/criminal-investigation/bitfinex-hacker-and-wife-plead-guilty-to-money-laundering-conspiracy-involving-billions-in-cryptocurrency
- https://www.justice.gov/opa/pr/two-arrested-alleged-conspiracy-launder-45-billion-stolen-cryptocurrency
- https://www.theblock.co/post/327107/heather-razzlekhan-morgan-sentenced-to-18-months-for-role-in-bitfinex-heist-bloomberg
- https://www.elliptic.co/insights/elliptic-analysis-new-york-husband-and-wife-arrested-for-laundering-5-billion-in-bitcoin-stolen-from-bitfinex-in-2016/
- https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1010/subpart-D/section-1010.430
Confidence high·Volatility low·Reviewed 2026-10-22·Owner unassigned
Contested
The survival model in part three is an illustration with stated assumptions, not an estimate. Nobody publishes a per-technique annual failure rate and the curriculum does not invent one. What the arithmetic demonstrates is the shape of the problem, which is that a conjunction of requirements held over many years falls fast, and that shape does not depend on the numbers chosen.
F106-04 and F106-05 own being a target and how target lists are assembled. This lesson owns the ledger as a surveillance surface and the linking events that attach an address to a person. Keep the split and do not re-derive target selection here.
The technique list is assembled from several sources: fictitious identities, automation, darknet markets, chain hopping, mixers including Bitcoin Fog, US business accounts and the gold coins Morgan buried from the Justice Department's plea announcement as republished by the IRS; AlphaBay from Elliptic; Wasabi, Monero and the recovery of the gold from a premises in California from TRM Labs, citing the forfeiture complaint. The seizure superlative is the Justice Department's own, from its February 2022 release; TRM Labs calls it the largest seizure in US history. Morgan's sentencing date is from The Block's report of 18 November 2024. TRM dates Lichtenstein's sentencing to 14 November 2024 in one place and 15 November in another; the government's release gives 14 November.
The five-year figure is the general retention period in the Bank Secrecy Act rules, 31 CFR 1010.430(d). It is a minimum an institution must keep, not a date on which records are destroyed, so the comparison in part four is between a private record kept for at least five years and a public one kept indefinitely.