‘Razzlekhan’ court document riddled with accounting blunders

US government officials may be miscounting how much crypto it intends to seize from a notorious pair of alleged criminals by as much as $1 million, a new court filing reveals. 

In a document filed Friday, the Department of Justice detailed a planned plea deal and seizure of assets for married co-conspirators Heather Morgan and Ilya Lichtenstein. The pair were arrested in February 2022 and released on bail six years after the hack of crypto exchange Bitfinex that resulted in the theft of $72 million. 

Since then, the value of the assets Morgan and Lichtenstein allegedly stole has ballooned to well over $3 billion. The pair garnered a degree of media notoriety when the charges were first unveiled, with Morgan in particular receiving attention for her flamboyant personality and rap alter-ego, Razzlekhan. 

The seizures laid out in the document will be significant, totaling billions of dollars across a half dozen blockchains. 

However, a blockchain analysis conducted by Blockworks shows that between the omissions of funds in listed addresses, recent transfers between addresses, and interest earned from DeFi protocols, US officials may have undercounted how much crypto they could be seizing by upwards of $1 million on the Ethereum blockchain alone. 

One address listed in the document refers to roughly $1,997,000 in USDT deposited in Yearn Finance. The value of the deposits is now $2,053,000, after interest. Yet the same address also contains USDC and CRV deposits on the lending marketplace Aave worth an additional $717,000 that is not mentioned elsewhere in the document. 

Another address contains $3.6 million USDT deposited in Yearn. However, this address transferred the deposit tokens in December 2022, along with $6.5 million in aUSDC, to a second address containing assets worth a cumulative $37 million in USD, some of which is mentioned elsewhere in the document and does not take into account the interest from Aave or Yearn.

A final address referring to Yearn Finance deposits of $1.7 million still holds the assets listed and does not contain additional assets, but has earned $54,000 since the initial deposit. 

The document also makes reference to addresses “seized from wallets recovered from Defendants’ online storage account and an external hard drive recovered from the Defendants’ residence” without listing specific Ethereum addresses. 

However, a blockchain analysis conducted by Blockworks identified an address containing appropriate amounts of aUSDC, USDC, USDT, WETH, yvUSDT, and other assets. This address also appears to have served as a gathering point for other sums, particularly of native ETH, mentioned elsewhere in the document. 

In one particularly puzzling example, the document refers to an address containing a fraction of a single Curve CRV token. However, the 0x hexadecimal string does not refer to an Ethereum account, but instead a transaction hash where the CRV was transferred between wallets.  

Between the other blockchain addresses listed, there may well be additional funds derived from forks and airdrops not listed in the document as well.

One possibility is that some of the funds in these addresses were legitimately earned by Lichtenstein and Morgan — and they may well emerge from the proceedings with significant wealth. 

More likely, however, is that the government agencies tracking the assets erred in their blockchain accounting and have understated the holdings they intend to seize.

---

Get the news in your inbox. Explore Blockworks newsletters:

• Blockworks Daily: Unpacking crypto and the markets.
• Empire: Crypto news and analysis to start your day.
• Forward Guidance: The intersection of crypto, macro and policy.
• 0xResearch: Alpha directly in your inbox.
• Lightspeed: All things Solana.
• The Drop: Apps, games, memes and more.
• Supply Shock: Bitcoin, bitcoin, bitcoin.