How blockchain forensics traced a peel chain across 2,000 wallets — and caught the launderers in a Walmart bag.
On August 2, 2016, hackers exploited Bitfinex's multi-signature wallet system and walked away with 119,754 BTC — worth $72 million at the time. The funds sat mostly dormant for years. Then, in 2022, blockchain investigators finally traced the full laundering trail and the DOJ seized $3.6 billion of it — the largest ever. What they found was a masterclass in on-chain forensics.
Ilya Lichtenstein and Heather Morgan didn't cash out quickly. They spent six years attempting to layer the funds through a technique called a peel chain — one of the most common BTC laundering patterns and one of the most traceable.
The 119,754 BTC was split across thousands of wallets. Each wallet received funds and forwarded most to the next, "peeling off" small amounts at each hop. The result: a 2,000-node transaction graph that took analysts months to map.
Some funds were converted to Monero (XMR) — a privacy coin designed to be untraceable. This is where the trail genuinely went cold for investigators. Converting back out of Monero created fresh, unlinked BTC.
Small amounts were cycled through darknet markets and converted to Walmart gift cards — classic layering to create distance from the original theft.
Attempts were made to use AlphaBay and decentralized exchanges to further obscure origin. Investigators identified these hops through address clustering — wallets that transact together frequently are likely controlled by the same entity.
The breakthrough came from a cloud storage account. Investigators found an encrypted file on Lichtenstein's cloud drive that contained the private keys to the original Bitfinex hack wallets — essentially a self-incriminating ledger of every address in the chain.
| Pattern observed | ClearChain signal |
|---|---|
| 2,000+ single-use wallets forwarding >95% of funds | Rapid fund movement + high-risk counterparty |
| Interaction with known darknet market addresses | High-risk counterparty (+10 pts) |
| Wallets on OFAC SDN list (post-designation) | OFAC/SDN match (+40 pts) → CRITICAL |
| Volume anomaly on fresh wallets moving large BTC | Volume anomaly (+5 pts) |