Accused crypto scammer Ilya “Dutch” Lichtenstein was ordered held without bond following a bail hearing on Monday during which prosecutors laid out what “could literally be called the electronic version of the smoking gun,” Chief Judge Beryl Howell of the Washington, D.C. federal district court said Monday.
Lichtenstein, 34, and his wife, 31-year-old tech entrepreneur and aspiring rapper Heather Rhiannon Morgan, are accused of attempting to launder billions of dollars in Bitcoin stolen in a 2016 hack. The cryptocurrency, worth about $71 million at the time, was worth $4.5 billion by the time they were arrested on Feb. 8. The feds have so far seized $3.6 billion of that total, which constitutes the largest financial seizure in U.S. history.
The couple had managed to liquidate roughly $2.9 million of the purloined Bitcoin before getting caught, according to prosecutors, who said the couple thought they had “succeeded in outsmarting” the feds up until they were taken into custody, Assistant U.S. Attorney Catherine Pelker said during today’s three-hour-plus court session. Investigators have still not succeeded in cracking at least 24 accounts allegedly controlled by Lichtenstein that contain roughly $328 million in illicit crypto.
Lichtenstein and Morgan appeared in court wearing prison greens and face masks, with their parents observing the proceedings from the gallery. Prosecutors warned that Lichtenstein, who was born in Russia and grew up outside of Chicago, is a dual citizen of the United States and Russia, which does not have an extradition treaty with the U.S. Further, the government said Lichtenstein and Morgan were in the planning stages of starting a new life as fugitives, using Ukraine or Russia as a “launching point” to go on the run elsewhere under false identities.
Arguing against allowing Morgan—whom the couple’s shared defense lawyer, Samson Enzer, attempted to portray as significantly less culpable than Lichtenstein—to remain free pending trial, prosecutors discounted “this suggestion that Ms. Morgan is some sort of naive wife who may have been unwittingly co-opted into her husband’s scheme here.” (Enzer’s co-counsel, Anirudh Bansal, missed the hearing after getting stuck on a train from Connecticut to D.C. Howell recommended heading down the night before for future hearings.)
“It bears noting that Ms. Morgan is highly intelligent, with a graduate degree in economics, and has sufficient cryptocurrency and technical know-how such that if she were released, even if her husband burned the keys, she would absolutely have the ability and the connections to access the stolen crypto to purchase identities off of the dark net and disappear,” they argued.
Further, prosecutors noted that Morgan, a West Coast native who headed up her own “cold-email” marketing company and has performed as a hip-hop artist under the name “Razzlekhan,” has “very strong ties to Hong Kong, having lived there previously, having businesses set up there. It would also be very difficult for us to extradite. It’s not impossible. but difficult.”
Nevertheless, Howell said she believes Lichtenstein has “more facility and skills” than Morgan does when it comes to acquiring false identities, setting up pseudonymous accounts, and “accessing and manipulating cryptocurrency.” At the same time, the one-time Forbes contributor was fully aware and knowingly participated in the money laundering portion of the alleged scheme, Howell declared, ordering Morgan freed on $3 million bond, secured by her parents’ home in Northern California. She will now be placed under house arrest, with strict location monitoring and a raft of stringent conditions, said Howell.
Howell noted the strength of the allegations put forth by prosecutors this far, while at the same time criticizing Enzer—who, before entering private practice, helped lead the government’s prosecution last year of fugitive software magnate and fringe political figure John McAfee—for “obvious misdirection to draw attention away from the heavy weight of the evidence.”
Prior to being placed in handcuffs by federal agents last week, the attention-grabbing duo were sure they had gotten away with the scheme, according to Pelker.
The two remained certain that “even if we had been able to trace some transactions to their accounts, that they had laundered them well enough that they would have plausible deniability—that it just happened that some small subset of the [proceeds] from the hack went to their account,” she said in court on Monday.
In walking Howell through a timeline of the investigation, prosecutors said Lichtenstein and Morgan got a notice from their internet service provider last November, informing them that the U.S. government had requested access to their online records. The move by the feds was meant to be kept secret, but the couple were tipped to the subpoena thanks to “an administrative oversight,” they explained.
On Jan. 5, 2022, federal agents executed a search warrant of the Wall Street apartment Morgan and Lichtenstein shared. About three weeks later, authorities began seizing the $3.6 billion in Bitcoin the pair are accused of attempting to launder, culminating in their Feb. 8 arrest.
Even though they ostensibly knew they were facing serious trouble, Morgan and Lichtenstein didn’t skip town or try to liquidate any of the assets to which prosecutors think they still have access, said Enzer in arguing for both defendants to be released.
But prosecutors described what they called a “fairly fundamental misunderstanding as far as what the defendants knew at the time of the search of their apartments,” saying that Lichtenstein and Morgan still had no idea that investigators had gotten into a cloud storage account with strong evidence against both of them, as well as a folder controlled by Lichtenstein that contained the private keys to a digital wallet holding stolen Bitcoin.
During the next week, Morgan and Lichtenstein “continued to hold, up until they were arrested, that they had succeeded in outsmarting us,” they said. “That even if we had been able to trace some transactions to their accounts, that they had laundered them well enough that they would have plausible deniability—that it just happened that some small subset of the [proceeds] from the hack went to their account.”
Although friends and associates say Lichtenstein and Morgan did not spend wildly and seemed to be well-off but not ludicrously wealthy, there were occasional signs that something was slightly suspicious.
“It never seemed like she really had a normal day job,” a cousin of Morgan’s told The Daily Beast shortly after her arrest. “At one point, about three years ago… there was some mention of her being, like, a millionaire… I always wondered how she had so much money, but damn.”
Last week, after a New York City magistrate’s order for the release of both Lichtenstein and Morgan was temporarily put on hold pending today’s decision by Howell, Lichtenstein and Morgan’s attorneys filed a brief claiming the two desperately want to become parents and previously harvested and froze several embryos now being stored at a hospital in New York City.
In a letter to Howell, Enzer said Morgan “can only conceive through in vitro fertilization because she suffers from endometriosis. The couple would never flee from the country at the risk of losing access to their ability to have children, which they were discussing having this year until their lives were disrupted by their arrests in this case.”
Countering the defense’s claims, prosecutors argued in a filing of their own that Lichtenstein and Morgan had long been gathering the necessary tools for a life on the run. In a section of the filing titled “Suspicious Ukraine Activity,” prosecutors shared details of a month-long trip the two took to Eastern Europe in 2019.
“The couple’s activities in Ukraine at times appear pulled from the pages of a spy novel,” it says, noting that agents searching the pair’s New York City apartment discovered, among other things, two books with secret compartments made by hollowing out the pages.
After gaining access to Lichtenstein’s cloud storage account, investigators say they found “numerous files…that contained notes about money laundering and/or false identification documentation with Ukrainian connections. A folder they discovered was labeled “personas,” with subfolders containing Russian and Ukrainian identification documents in other people’s names, the filing says.
Along with the suspicious “personas” folder were notes and information about obtaining debit cards on the dark web, receiving packages anonymously in Ukraine, and avoiding security cameras in Ukrainian post offices.
“I mean, we’ve got to admit it is not normal for law-abiding citizens to have access to accounts of vetted darknet vendors selling debit cards, false passports, and false personas,” Howell said on Monday.
If convicted, the two face up to 20 years in prison.