Bitcoin. NFTs. A PPP loan. And a rapping tech entrepreneur.
A New York City couple were arrested Tuesday morning by federal agents on charges of laundering some $4.5 billion stolen in a massive 2016 cryptocurrency exchange breach.
As might be expected in 2022, the latest federal law enforcement takedown features the buzziest of buzz-worthy themes—as well as some pretty awful rap lyrics.
Ilya “Dutch” Lichtenstein, 34, and his wife, Heather Rhiannon Morgan, 31, are accused of helping to “wash” 119,754 Bitcoin pilfered from Bitfinex and allegedly transferred into a digital wallet controlled by Lichtenstein, a dual citizen of both the U.S. and Russia, prosecutors announced. Court documents describe an incredibly complex investigation carried out by special agents with the IRS, FBI, and the Department of Homeland Security.
U.S. District Court for the District of Columbia
“Today’s arrests, and the department’s largest financial seizure ever, show that cryptocurrency is not a safe haven for criminals,” Deputy Attorney General Lisa O. Monaco said in a statement. “In a futile effort to maintain digital anonymity, the defendants laundered stolen funds through a labyrinth of cryptocurrency transactions. Thanks to the meticulous work of law enforcement, the department once again showed how it can and will follow the money, no matter what form it takes.”
Lichtenstein and Morgan are scheduled to make an initial appearance in federal court this afternoon. Anirudh Bansal and Sam Enzer, the couple’s lawyers, did not immediately respond to The Daily Beast’s request for comment. Lichtenstein’s father, Illinois-based mortgage broker Yevgeniy Likhtenshteyn, told The Daily Beast on Tuesday that he was unable to comment on his son’s arrest.
Morgan, who is also a rapper and goes by the stage name Razzlekhan, got engaged to Lichtenstein in 2019.
“I got engaged to my best friend and the woman of my dreams!” he wrote on Facebook, describing “how it all went down.”
A photographer who was contacted by Morgan to document the engagement told The Daily Beast that she described herself and Lichtenstein as “weird and eccentric,” saying that they both enjoyed “taxidermy and weird art.”
Morgan, who often referred to herself in the third person, said she was “flashy and colorful,” while Lichtenstein was “into gray and black and some leather and goth ninja,” according to the photographer, who asked not to be named.
The pair wanted photos of “Dutch and all his wives,” which would be Photoshopped shots of Lichtenstein with Morgan “as Razzlekhan with multiple personas,” according to the photographer, who said the whole project “sounded exhausting.”
“I was not lying when I said I was too busy to take on this project,” he said. “But listening to these raps she made, they were so bad, I was kind of like, ‘I don’t know if I can deal with this.’ Because sometimes, for a certain price, you can make your schedule work. And I couldn’t really come up with a number.”
Morgan has been a Forbes contributor, advising burnt-out execs to “try rapping” in order to recharge their batteries. One article Morgan wrote, which was published in June 2020, was titled, “Experts Share Tips To Protect Your Business From Cybercriminals.”
Dating back to July 2017, Morgan has contributed at least 55 articles to the website. A Forbes spokesperson told The Daily Beast that Morgan was a “contributor up until September 2021,” at the same time noting she “was never a Forbes employee.”
“We are always adding and editing our contributor network, and don’t comment on specific contributors who are no longer part of our network,” the spokesperson added.
Morgan contributed to Inc. as well, publishing articles under headlines such as “How to Start a Conversation With Even the Busiest Leaders,” and “How I Flew to 13 Countries in First Class Without Buying Tickets.”
In addition, Morgan is the founder of a company called SalesFolk, which describes itself as “the first company to specialize in cold email copywriting.”
Morgan and Lichtenstein allegedly “employed numerous sophisticated laundering techniques, including using fictitious identities to set up online accounts; utilizing computer programs to automate transactions, a laundering technique that allows for many transactions to take place in a short period of time; depositing the stolen funds into accounts at a variety of virtual currency exchanges and darknet markets and then withdrawing the funds, which obfuscates the trail of the transaction history by breaking up the fund flow,” prosecutors said.
In a criminal complaint unsealed Tuesday, Morgan is accused of hiding the actual source of the digital assets she was attempting to deposit into a new institutional account at an unnamed virtual currency exchange.
“My boyfriend (now husband) gifted me cryptocurrency over several years (2014, 2015,), [sic] which have appreciated,” she allegedly wrote in an email. “I have been keeping them in cold storage.”
Morgan and Lichtenstein deceived multiple financial services firms, misrepresenting their intentions with one by claiming another crypto account would be used to receive customer payments to be processed “by a U.S.-based financial services and software-as-a-service company,” the complaint states. Yet, the feds say the “bulk of the funds received” were almost solely made up of five wire transfers from another crypto account controlled by the two, totaling more than $758,000.
“The only other significant deposit to the account was an approximately $11,000 U.S. Small Business Administration Paycheck Protection Program (PPP) loan advance provided in response to the COVID-19 crisis,” the complaint states.
Prosecutors said the pair spent the proceeds from the theft on gold, NFTs, and “mundane things such as purchasing a Walmart gift card for $500.” In a statement, Bitfinex said it is working with the Department of Justice to claw back the stolen Bitcoin.
“Criminals always leave tracks, and today’s case is a reminder that the FBI has the tools to follow the digital trail, wherever it may lead,” FBI Deputy Director Paul M. Abbate said on Tuesday.
Tom Robinson, a cryptocurrency forensics specialist and the chief scientist and co-founder of Elliptic, a London-based firm that investigates crypto-based financial crime, believes Lichtenstein and Morgan were likely identified via information federal law enforcement seized in 2017 from the darknet marketplace Alphabay. As laid out in the complaint against the duo, the feds followed the money from Alphabay to a crypto account in Lichtenstein’s name.
“The laundering techniques used here were quite sophisticated,” Robinson, who has been tracking the Bitfinex heist for the past five years, told The Daily Beast. “However, this case demonstrates that when blockchain analytics is combined with the kind of data that law enforcement can get their hands on, cryptocurrencies such as Bitcoin are highly traceable.”
A little over a week ago, Elliptic spotted $3.5 billion being moved from a crypto wallet associated with the 2016 Bitfinex hack to a new address. At the time of the theft, Bitfinex offered a reward up to $400 million for the return of the stolen Bitcoin, even if they had to pay it to the hackers themselves.
As her alter ego “Razzlekhan,” Morgan described herself as “like Genghis Khan, but with more pizzazz.”
“No one knows for sure where this rapper’s from—could be the North African desert, the jungles of Vietnam, or another universe,” her website says. “All that matters is she’s here to stick up for misfits and underdogs everywhere. (We do know that she’s descended from a nomadic tribe, though!)”
According to public records, Morgan is actually from Northern California.
Morgan, who sometimes shortens “Razzlekhan” to “Razz,” claims to have synesthesia, a neurological phenomenon in which people “see” sounds and “hear”colors. Because of this, Razz’s “art often resembles something in between an acid trip and a delightful nightmare,” her site says. “Definitely not for the faint of heart or easily offended, Razz likes to push the limits of what people are comfortable with. Her style has often been described as ‘sexy horror comedy,’ because of her fondness for combining dark and disturbing concepts with dirty jokes and gestures... Whether that leads to something wonderful or terrible is unclear; the only thing that's certain is it won’t be boring or mediocre.”
Her lyrics include lines about “getting high in the cemetery,” adding, “I love me some grave grass.”
“Puff puff pass… f*ck the park; it’s full of f*ck boy sex slaves,” she rhymes in one of her tracks. “I’m about to light it up; When a big ass horse pulls up; In a dark chocolate ‘67 Porsche; ‘How much for a hand job?’; Yo, I’m not some kind of slu*tty basic ho; About to jack off a horse for a ride in yo po-shhhh.”
Harrisburg, Pennsylvania musician Sterling Walden, who uses the name “Keyzus” professionally, produced some of Morgan’s hip-hop tracks—and said he was shocked by the charges.
“But we only dealt on the music business,” Walden told The Daily Beast. “For the most part, everything seemed pretty much regular. Heather was really a decent person. Super kind, super fair in business, and I never really had any bad thoughts about her, or heard anything like this. I’m still in disbelief, like, I honestly don’t believe it.”
Morgan found Walden on the internet, he said, after which she hired him to record her. She didn’t appear to have tremendous wealth, but was as well-off “as the average tech CEO,” according to Walden, who said he didn’t see Morgan spending wildly or going out and “buying crazy stuff.”
Lichtenstein is originally from Illinois, according to public records, which show family members spelling the name as “Likhtenshteyn.”
In his LinkedIn bio, Lichtenstein claims to have been the co-founder and CEO of a San Francisco sales and marketing company called MixRank. However, MixRank’s website makes no mention of him. The company did not immediately respond to The Daily Beast’s request for comment.
A cat owner, Lichtenstein described his over-the-top proposal to Morgan as “something memorable that would really show how much I love and value the real Heather, not just the badass entrepreneur but also the ultra-weird creative genius.” But he also knew that Morgan “would want any proposal to be pragmatic and also add business value,” Lichtenstein wrote on Facebook.
“A plan began to form...As you may know, Heather is not just a tech entrepreneur...she is also Razzlekhan, the fearless rapper,” the post says. “And what better way to propose to an entrepreneur/rapper than with a weird, creative multi-channel marketing campaign? Sweet, thoughtful, creative, positive ROI. Perfect!”
On Monday, a dazed-seeming Morgan posted a video on social media complaining about a bad experience she had at the nail salon.
“Can I be real with you about something?” she says to the camera, a zebra hide visible on the wall behind her. “You know what, I really, really, really hate nail stuff. For the longest time, I only painted one nail, my Razzle nail,” continuing to gripe about her nails being “thin” due to a manicurist who “sanded [them] down.”
The next day, she would be in handcuffs.
Michael Zweiback, a former assistant U.S. attorney for the Central District of California who served as chief of the Department of Justice’s Cyber & Intellectual Property Crimes Section, told The Daily Beast that the charges against Morgan and Lichtenstein are meant to “make people aware of the fact that [DOJ is] doggedly attempting to pursue this particular area” and that cryptocurrencies are not as untraceable as some believe.
The feds are now sending a message to cybercriminals that “they can’t capitalize on this and keep their anonymity to the degree that certainly has been publicized,” he said, noting that although Bitcoin “sounds daunting,” what Morgan and Lichtenstein are accused of doing is little more than a modern twist on tried and true techniques.
“I once had a federal judge tell me that there’s no such thing as a new fraud scheme, that it’s really all old schemes that are just sort of relabeled and repackaged,” Zweiback added. “A lot of what’s described [in the complaint], even though it sounds very novel and new—and certainly the technology is novel—but the methods are not that different from what we experienced decades ago, when we were tracking money that was being laundered by other organized crime groups.”
It will be “curious,” he said, to see what evidence prosecutors introduce in court in terms of emails, text messages, and communications between Morgan and Lichtenstein and the others involved in what Zweiback believes is “most likely a global conspiracy.”
“They certainly not only obtained it, but they maintained control in a way that suggests that there are probably many other individuals involved in this,” he said.
In a court filing on Tuesday, prosecutors described the pair’s actions when the feds executed a search warrant at their Wall Street apartment on Jan. 5.
“During execution of the search warrant, Morgan tried to lock her cellular phone to prevent law enforcement examination,” the filing states, adding that the two retained counsel at that time and “engaged in preliminary discussions with the government, although the full nature and scope of the government’s investigation was not disclosed at that time.”
When the two appeared in court on Feb. 8, Morgan said she had “undergone a surgical procedure” on Jan. 31, and was scheduled to have “oral surgery” on Feb. 9.
Lichtenstein posted $5 million bond, with five co-signers, along with his parent’s Chicago home as security. He was given house arrest, with electronic monitoring and a restriction on his use of smart phones, according to the filing. Morgan put up $3 million bond, with the same conditions as Lichtenstein. Their passports were seized, and both are “restricted from some (but not all) financial transactions, including restrictions on any cryptocurrency transactions.” However, a judge in Washington, D.C., subsequently stepped in and ordered them jailed pending further review. If convicted, Lichtenstein and Morgan face a maximum of 25 years in prison.
—With additional reporting by Zachary Petrizzo
