How ‘cringey’ TikTok couple pulled off ‘biggest heist ever’ for £3.5bn and earned nickname ‘Bitcoin Bonnie and Clyde’
WHEN cops began to unearth links between aspiring rapper Heather Morgan, known to her fans as Razzlekhan, and a £3.5 billion cryptocurrency heist, they weren’t convinced they had the right woman.
This was a hipster in her 30s who rapped about being a “bad b***h” and “dirty h*e” in a series of eccentric music videos, including one where she performed topless with nothing but star-shaped stickers covering her nipples.
On the surface, the 34-year-old certainly didn’t act like someone who had the mastery or know how to swindle investors out of billions of pounds and go undetected for years.
But it turns out, her outlandish raps were littered with clues proving she did.
In her tunes, Heather referred to herself as the “Crocodile of Wall Street”, a play on the infamous book and film about dishonest New York stock traders in the Nineties, and boasted: “I’m sly like a ‘gator.”
She rapped claims about how “following rules is for fools” and even dedicated her tune #VersaceBedouin to “entrepreneurs and hackers”.
read more on crime
Lyrics for her song California Rollz also read: “Insider trading tips sounding real juicy, think the short one wanna screw me, keeps staring at my booby.”
Her song Gilfalicious says: “I’m mother-f*****g filthy, rent boys on payroll cause I’m so damn wealthy.”
But her online gloating only made the target on her and her husband's back bigger when cops began to link them to the 2016 Bitfinex exchange hack.
“I was desperate to figure out what exactly happened,” says Chris Janczewski, lead investigator on the case.
“Especially seeing them acting as if they might have gotten away with it.”
Heather was sentenced to 18 months in prison last month after she and her husband Ilya Lichtenstein, 36, were convicted of laundering £3.5 billion ($4.5 billion) in Bitcoin after the was hacked on August 2, 2016.
Bitfinex is the world's second-largest cryptocurrency exchange, and allows customers to trade cryptocurrencies or digital currencies, and withdraw them as cash.
According to court documents, Ilya hacked into the cryptocurrency network using advanced tools and techniques.
Once inside, he fraudulently authorised more than 2,000 transactions, transferring 119,754 Bitcoin from Bitfinex to a cryptocurrency wallet under his control.
The esteemed hacker, who enlisted the help of his wife Heather to launder the cryptocurrency, then took steps to cover his tracks by deleting access credentials and other log files that could have revealed what he was up to on Bitfinex’s network.
The couple, later dubbed ‘Bitcoin Bonnie and Clyde’, cleared out more than half of the Bitfinex inventory - 119,754 coins in all - which worked out at around £56.6 million at the time.
The operation was so sophisticated that even US intelligence agencies were left scratching their heads as to how it could’ve happened, and who was responsible.
Chris Janczewski, lead investigator on the case, compared Ilya covering his tracks to someone “erasing fingerprints at the scene of a crime”.
In the years that followed, the couple became prime suspects, despite breaking the usual mould of what cyber criminals look like.
I was always kind of weird and different, so I didn’t really have friends, and often clashed with the school administration for refusing to conform
Heather Morgan (A.K.A Razzlekhan)
But there was a big problem.
The value of Bitcoin rocketed in the years that followed the hack, meaning Ilya and Heather were faced with laundering BILLIONS rather than millions.
The estimated value of their hack is now around £3.5 BILLION.
So, how did they get away with their high-profile heist for nearly six years and what was the mistake Heather made which exposed the couple and led to their downfall?
THE EARLY DAYS
Heather was from the “poor side of town” in Chico, California, pals revealed in a new Netflix documentary about her crimes, Biggest Heist Ever. They also described her as an isolated teen who was picked on for being “awkward”.
She attested to this herself when annotating lyrics to her 2019 song Menace To Society on music platform Genius.
The aspiring rapper revealed: “I’ve never really fit in. I’m from a small rural town, and went to a very small school for junior high. There were less than 80 kids in the entire school.
“I was always kind of weird and different, so I didn’t really have friends, and often clashed with the school administration for refusing to conform.”
WHAT IS BITCOIN?
Bitcoin is a digital currency that lets people send and receive money directly without a bank.
It runs on a decentralised network of computers called the blockchain, which keeps a secure record of all transactions.
It is typically traded on centralised exchanges (CEXs), which are online platforms where people can buy, sell, and trade cryptocurrencies.
Bitcoin is the most popular cryptocurrency in the world due to it being the first invented in 2009, but other versions include Ethereum, Dogecoin and Polkadot.
Users deposit their funds into CEX wallets, and can buy and sell cryptocurrencies on these platforms.
Popular CEXs include Bitfinex, Binance, Coinbase and Kraken.
Meanwhile, Ilya was born in Russia but raised in Glenview, Illinois, an affluent town with around 50,000 inhabitants - and just like Heather, he didn’t fit in.
Old school pals recall him being a “nerdy” boy who other students would mock for having immigrant parents.
Heather and Ilya both pursued computer science related subjects at school and university, before going onto forge careers in tech.
They met in San Francisco in 2014 while mingling in the same tech industry circles.
Moreover, cops didn’t see any movement of the stolen Bitcoins in the year that followed.
The cyber funds were just sitting in Ilya's digital wallet and growing in value.
That was until early 2017, when software security companies noticed that someone was laundering some of that stolen crypto through a dark-net marketplace.
At the same time, Heather and Ilya had moved to New York City and were splurging £5,131 ($6,500) a month on rent.
Pals later described their move from San Francisco to the Big Apple as “pretty abrupt”.
Heather was desperately trying to succeed as a rapper, releasing songs critiquing healthcare in the US, addressing racism and slamming men who she had worked alongside in the past.
At the same time, she was plugging away at SalesFolk and charging around £100 to, ironically, write articles about cybersecurity for Forbes.
'CRINGEY' RAPPER
Heather was also growing her TikTok and YouTube stardom through music videos and vlogs, something which critics have described as a "cringey" attempt at becoming famous.
One video on her channel shows her unboxing “25 prosthetic eyeballs” and brainstorming ways to wear the faux organ as a fashion accessory.
Cops couldn’t believe this eccentric woman was capable of pulling off one of the biggest cryptocurrency heists in history.
“I felt some level of surprise seeing all the videos,” lead investigator Chris Janczewski recalls in Netflix's new documentary about the crime, Biggest Heist Ever.
“But the mass amount of social media posts was actually a benefit for us because they were shooting videos inside their apartment.
“They’re giving you an opportunity to look inside and see what’s going on that you otherwise would not get [as an investigator].”
Ilya proposed to Heather in June 2019 by filling New York City with billboards and posters promoting her rapping persona, Razzlekhan.
The pair planned to tie the knot in November 2020, but had to postpone to 2021 due to the pandemic.
Cops believe they wanted to get hitched as “one last hoorah” before disappearing to Ukraine or Russia and extracting the rest of the stolen funds overseas.
They were in a situation where they couldn’t access the money they had stolen because, while Bitcoin was anonymous, they’d have to provide details on their identities to cash it out.
The couple both speak Russian and were aware that there’s no formal extradition treaty between there and the US, meaning they would’ve been able to live without fear of being deported for their crimes.
And just before the pandemic in 2019, they had taken a monthlong trip to Ukraine to allegedly plan a new life - with new identities - together.
POLICE DEEP DIVES
They were accused of picking up numerous packages from the dark web which they had delivered to a nearby hotel, containing fake Ukrainian passports, SIM cards and details for surreptitious bank accounts.
Investigators used a variety of defunct servers, Bitcoin transaction trackers and intelligence tools to trace the nuggets of money that were being pulled from the stolen funds.
“Around 2020, blockchain analytics software started to peak,” reveals lead investigator Chris Janczewski. “Other companies were able to help with our investigation.
“A lot of momentum in the case started to pick up.
“I started mapping the flow of the funds and making this spiderweb of tens of thousands of transactions in various accounts.”
And a huge portion of the leads pointed to one address: Heather and Ilya’s skyscraper apartment on Wall Street, New York.
“Every time we got to the centre of the spiderweb, we hit accounts that were in the name of Mr Lichtensein and Miss Morgan,” Janczewski adds.
Deep dives on social media ensued, and Heather’s fondness for sharing her life gave cops a lot to work with.
Every time we got to the centre of the spiderweb, we hit accounts that were in the name of Mr Lichtensein and Miss Morgan
Chris Janczewski
It was obvious to investigators that she wasn’t earning enough money from her small-time tech business and rap career to fund her supposed lifestyle of first class flights around the world, staying in the Ritz and eating at New York’s most coveted restaurants.
Ilya was working on new start-ups - ironically including one dedicated to helping people protect their Bitcoin funds - and hired a number of fake employees who were paid millions of dollars in the digital currency.
Some of them had sham LinkedIn profiles, but as far as cops could see, they didn’t exist in the real world and had no personal social media accounts.
Ilya also purchased (and buried) gold coins with some of the stolen funds in a bid to convert it into something tangible that he could eventually somehow exchange for cash.
SILLY MISTAKES
Experts predict that by 2021, the couple were getting antsy sitting on billions of pounds worth of Bitcoin.
This anxiety was supposedly pushing them to desperately explore different ways to launder the money before jetting off to Ukraine or Russia.
However, their laundering efforts often found them looking at frozen accounts and dead ends, due to how difficult it is to turn cryptocurrency into cash without handing over a legitimate identity.
In late 2021, ignorant of a sophisticated police surveillance operation which was now underway, the couple boarded a plane and flew across the US to get married in California.
They hosted an extravagant ceremony, complete with a Razzlekhan performance, and then whisked guests to a mansion for an after party with a DJ, waitresses and free-flowing booze.
However, it was their OTT wedding which would prove to be their downfall.
Heather was so desperate to access the stolen billions that she bought gift cards in place of traditional wedding favours - a decision that led cops directly to her doorstep.
The prepaid cards linked back to Heather's name and address, giving investigators the incriminating transaction they’d been waiting for to issue a search warrant on their high-rise home.
CRUNCH TIME
Special agents swooped the couple's New York apartment in January 2022 at 3am in hope of catching the them off guard and uncovering the passwords that would give them access to the stolen Bitcoin.
If the passwords to access the stolen crypto funds were in Ilya and Heather's possession, then cops would have enough proof to arrest them for the 2016 hack.
They unearthed a bag of burner phones, multiple hollowed out books, stacks of foreign currency and spy-like gadgets.
The couple weren’t arrested after the search warrant as cops didn’t find the passcodes, but they did take hold of a number of their belongings.
They were free to leave the country - but their alleged plan to relocate across the world in Ukraine wasn’t feasible due to Russia invading the country.
Heather continued to act normal on social media and posted as if nothing had happened, including videos of her moaning about nail salons and eating pancakes in five star restaurants.
Meanwhile, investigators - including Chris Janczewski - were building their case and analysing digital files they had seized from the couple during the 3am raid.
After painstaking nights trawling through documents, the FBI assisted Chris in unlocking an encrypted spreadsheet.
I started mapping the flow of the funds and making this spiderweb of tens of thousands of transactions in various accounts
Chris Janczewski
In that spreadsheet were the passwords for over 2,000 of the stolen Bitcoins.
This was enough proof that Heather and Ilya possessed the passcodes to the stolen currency, and thus it was enough for the FBI to issue an arrest warrant.
The billions of dollars were transferred from Ilya’s digital wallet to the US government, meaning the couple had now lost possessions of the cryptocurrency.
Cops swooped on their address in another early morning raid on February 8, 2022 and arrested the couple, who communicated with each other in Russia while they were getting handcuffed.
In August 2023, they both pleaded guilty to money laundering conspiracies arising from the Bitfinex hack.
Ilya took the majority of the blame. He pleaded guilty to conspiracy to commit money laundering, which carries a maximum penalty of 20 years in prison in the US.
Heather pleaded guilty to one count of money laundering conspiracy and one count of conspiracy to defraud the United States, each of which carries a maximum penalty of five years in prison.
Last month Heather was sentenced to 18 months in prison, while Ilya was handed 60 months on the recommendation of DOJ Trial Attorney Jessica Peck.
Guess what? It's over. And I'm very excited that I will soon be telling my story and sharing my thoughts
Heather Morgan (A.K.A Razzlekhan)
The Razzlekhan YouTube channel is still very much live - despite the last post being a music video for her song Social Distance on February 18, 2022 - with just over 3,000 subscribers and a slew of historic eccentric videos.
You can watch Biggest Heist Ever on Netflix as of today, December 6.
Despite supposedly being in prison, Heather posted "statement" to her social media channels earlier this week.
She said: "I'm sorry I've been gone for a little while. The last three years, I was battling a fed case. And I like to listen to my lawyers.
READ MORE SUN STORIES
"Well, guess what? It's over. And I'm very excited that I will soon be telling my story, sharing my thoughts and telling you more about the creative, other endeavors that I've been working on."
She finished the video by sticking her tongue out and saying: "Razzle Dazzle."