Couple Appears to Be Cooperating with DOJ

In February 2022, we blogged on the seizure of a record $3.6 billion in stolen Bitcoin (“BTC”) and an accompanying criminal complaint, charging husband and wife Ilya “Dutch” Lichtenstein and Heather “Razzlekhan” Morgan with conspiracy to commit money laundering and conspiracy to defraud the United States.  Last week, the couple pleaded guilty, pursuant to plea agreements with the government, with sentencing to follow. 

As we discuss below, both of their plea agreements contemplate attempting to reduce their sentences via cooperation with the Department of Justice (“DOJ”).  As we also discuss, this case presents a cautionary tale for financial institutions and the need to not “tip off,” unwittingly or otherwise, the recipients of grand jury subpoenas.

As we discussed previously in our review of the charging document, and as is now rehearsed in greater detail in the “Statement of the Offense and Related Conduct” (“Statement of the Offense”) filed in association with Lichtenstein’s plea agreement, he and Morgan engaged in a massive multi-faceted effort to launder the funds acquired via his 2016 hack of the Bitfinex virtual currency exchange (“VCE”).  This effort included a number of different tactics, including some that we discussed previously:

• Evading transaction thresholds that require financial institutions to practice enhanced customer due diligence, by setting up numerous accounts at various U.S. financial institutions and VCEs that each held small portions of the pilfered funds;
• Converting stolen cryptocurrency into fiat currency via foreign bank accounts (specifically at Russian and Ukrainian financial institutions) and then making cash withdrawals from U.S.-based ATMs;
• Using cryptocurrency mixing services, including ChipMixer, the operations of which we discussed this past March in the wake of its takedown by U.S. and European authorities.

Morgan’s plea agreement, as we will discuss, contains stipulations which are more defense friendly than those in Lichtenstein’s plea agreement.

The list of assets seized by the government is also indicative of Lichtenstein and Morgan’s “all of the above” approach to laundering the stolen funds. The list contains a veritable grab-bag of cryptocurrency seized from crypto wallets recovered from online storage accounts and one or more external hard drives in Lichtenstein’s possession: BTC, Bitcoin Cash (“BCH”), Bitcoin Satoshi Version (“BSV”) and Bitcoin Gold (“BTG”); Monero (“XMR”) (an “anonymity-enhanced” cryptocurrency) ; Ether (“ETH”) and Wrapped Ether (“WETH”); USDC Coin (“USDC”) and Aave USDC (“aUSDC”); Tether (“USDT”); and “various other tokens.” In an unintentional nod to a bygone era of grand theft, the seizures also include “[a]ssorted U.S. and Canadian gold coins excavated and recovered by law enforcement from” a location in California.

But the seizures also included funds held in accounts at several different U.S. banks. This highlights a continued sticking point for crypto criminals – despite the optimistic pitches by some of the technology’s evangelists, cryptocurrency is a long way from being routinely used as “money” in daily life.  At some point, the digital currency needs to be converted to traditional currency (or its electronic equivalent) in order to be spent on real-world items. And that requires providing information, or a simulacrum thereof, to a financial institution or a VCE – a submission that creates a record that can be cross-checked, tested, and eventually subpoenaed.

This not only increased the likelihood that Lichtenstein and Morgan would eventually be caught – it exposed them to further criminal liability under the “defraud the United States” prong of 18 U.S.C. § 371, under the novel theory that the duo’s frustration of the due diligence efforts of financial institutions caused those institutions not to comply with their obligations under the Bank Secrecy Act (“BSA”), including filing Suspicious Activity Reports (“SARs”) with the Financial Crimes Enforcement Network (“FinCEN”). Under this theory, FinCEN was defrauded by this failure, with Lichtenstein and Morgan bearing the responsibility.

The Statement of the Offense also contains a cautionary anecdote for financial institutions.  It states that in November 2021, just a few months before their arrests, Lichtenstein and Morgan were notified by an unnamed institution at which Lichtenstein held an account that it had disclosed records relating to his account to U.S. law enforcement.  This notification apparently occurred because the institution “failed to process a valid and timely extension of a non-disclosure order issued by the U.S. District Court for the District of Columbia,” and thus violated that order.  That inadvertent notification had ramifications: in reaction to it, the duo took actions to cover their digital tracks, including deleting data from various devices, and even throwing an unspecified device which “contained relevant, inculpatory evidence related to this criminal scheme” down a garbage chute.  Had the investigation not been as far along as it was, it’s conceivable that this failure on the institution’s part to stay abreast of its legal obligations could have had a deleterious effect on the government’s case, and earned the ire of DOJ and the District Court.

The Plea Agreements

Lichtenstein’s plea agreement contains numerous stipulations under the U.S. Sentencing Guidelines.  Assuming he receives a reduction for acceptance of responsibility, his advisory Guidelines sentencing range should be 121 to 151 months of imprisonment, prior to any downard depatures or variances.

Notably, in Lichtenstein’s plea agreement, Lichtenstein may qualify for a downward departure from the Sentencing Guidelines as a result of a “Section 5K1.1” motion by the DOJ as a result of any “substantial cooperation.”  Although the facts need to play out, the point is that Lichtenstein appears to be cooperating with the government against unnamed targets.  Similarly, but more unusually, the DOJ also agreed to potentially sponsor him for acceptance into the federal Witness Security Program.  The inclusion of this possibility is significant, as DOJ has explicit restrictions on making representations regarding Witness Security (see Justice Manual 9-21.310).

As for Morgan, and again assuming that she receives a reduction for acceptance of responsibility, she is facing the lower advisory Guideline sentence of 63 to 78 months imprisonment, prior to any downward departures or variances.  This result turns in part on the parties’ agreement that  Morgan had a “minimal role” in the offense.  Her plea agreement also contemplates the possibility of a downward departure due to substantial cooperation with the government.  Obviously, persons who transacted with Lichtenstein and Morgan should be nervous at this point.

The DOJ press release notes that the investigation is being run by the IRS Criminal Investigation D.C. Field Office’s Cyber Crimes Unit, the FBI’s Chicago Field Office and Virtual Assets Unit, and Homeland Security Investigations New York.  It also references “[s]ignificant assistance” provided by, inter alia, the U.S. Attorney’s Office for the Eastern District of Pennsylvania, which seems to be carving out space for itself in digital asset law enforcement – it’s the same office that filed the criminal complaint against the founder of ChipMixer (about which we blogged).

[View source.]