A staggering $20 million in cryptocurrency linked to U.S. government addresses has been moved to a new wallet, raising alarms about a potential theft.

The transactions originated from the government-controlled Bitfinex Hack Wallet, which housed part of the funds recovered from the 2016 attack on the Bitfinex crypto exchange. This resulted in a loss of nearly 120,000 BTC.

Fund Movements Deemed Suspicious

Blockchain security firm Arkham Intelligence was among the first to flag the suspicious activity, initially blaming government authorities for moving the funds.

The suspected hacker withdrew crypto worth about $5.4 million from the Aave lending platform, sending it to a new address created only five days prior. They then followed up with another $1.12 million in USDT, with the consecutive withdrawals being the first carried out by the address in eight months.

However, it was after the wallet started sending the tokens to another address, beginning “0x348,” which was previously linked to money laundering, that Arkham started tracking the movement of the funds, ultimately concluding that the case was indeed an exploit.

Alongside the earlier withdrawals, the alleged thief also moved an additional $446,000 worth of Ethereum (ETH) and $13.7 million in aUSDC, an interest-bearing version of the USD Coin deposited on Aave. The Bitfinex Hack Wallet received millions worth of the particular cryptocurrency in 2022, as well as their USDT iteration.

The suspect has shifted some of the stolen loot to instant exchanges, platforms that allow users to quickly swap one cryptocurrency for another without needing an account or going through a lengthy verification process.

Most blockchain security analysts agreed the transfers were suspicious, with ZachXBT pointing out that any funds moved to instant exchanges were “nefarious.”

Bitfinex Hack Details

The Bitfinex hack is one of the largest in crypto history. The perpetrators, now identified as Ilya Lichtenstein and his wife Heather Morgan, stole 119,754 BTC, worth an estimated $71.8 million at the time.

The two were arrested in February 2022 and later pleaded guilty to money laundering and fraud. At their arrest, the stolen stash had a market value north of $4.5 billion.

Lichtenstein received a five-year sentence for his role in the hack and subsequent money laundering activities. The short sentence resulted from his cooperation with authorities in other investigations, including turning state witness against Roman Sterlingov, founder of the Bitcoin Fog crypto mixing platform.

On her part, Morgan, also known by her rap stage name Razzlekhan, was sentenced to 18 months in prison and is currently free after serving her time.

Law enforcement agencies were able to recover about $3.6 billion worth of Bitcoin stolen in the Bitfinex attack, with portions of it returned to the exchange.