The U.S. government stated that it is not aware of any person who qualifies as a victim other than Bitfinex.
Bitfinex may be the only entity eligible to receive compensation related to the 2016 hack attack, which resulted in the theft of 119,756 bitcoin. This information emerged from a document filed by U.S. authorities in the case against Ilya Lichtenstein and Heather Morgan, the perpetrators of the cyber attack. According to the government, no other parties besides Bitfinex with compensation rights have been identified at this time.
Bitfinex loss management
To reimburse its customers after the incident, Bitfinex imposed a reduction of approximately 36% on all customer account balances to socialize the losses. To address these losses, Bitfinex issued tokens known as BFX. BFX holders could sell the BFX tokens on the market or sell them directly to Bitfinex at a fixed exchange rate of $1 per token. Additionally, accredited investors were offered the option to convert BFX tokens into shares of the parent company, iFinex.
Bitfinex managed to fully cover the losses within eight months. Customers who opted for shares also received new tokens called Recovery Right Tokens (RRT), redeemable by the exchange if the stolen funds were recovered. Currently, approximately 30 million RRT are still awaiting redemption. According to the court document, iFinex committed to reimburse RRT holders if the funds were recovered.
Compensation legislation
U.S. legislation, including the Crime Victims’ Rights Act and the Mandatory Victim Restitution Act, guarantees crime victims the right to full and timely compensation for their losses. These laws require offenders to provide compensation to victims, covering not only direct losses but also crime-related expenses.
The government revealed that there could be thousands of users whose accounts were depreciated in 2016 due to the attack. To help potential victims come forward, the government plans to create a website where users can obtain information and declare their victim status.
Investigations and arrests
In February 2022, the U.S. Department of Justice arrested Ilya Lichtenstein and Heather Morgan in connection with the attack, seizing cryptocurrencies worth $3.6 billion. The two subsequently pleaded guilty as part of a plea deal. The Department of Homeland Security later seized additional assets, including $312,219.71 in cash and 6,917 bitcoin cash in July 2023. The exchange plans to use the recovered funds to purchase the Recovery Right Tokens (RRT) issued after the attack and intends to allocate up to 80% of any remaining funds to holders of its native token, UNUS SED LEO.
