The following is a message to all Bitfinex customers who were affected by the hack on August 2, 2016.

You probably remember that, after the hack, Bitfinex implemented a 36.067% haircut for all users and distributed BFX tokens ("without release or waiver" [3]) to users in return. Each BFX token had a nominal face value of 1 USD but had a real value in the free market of less than 20 cents at the time of distribution [4]. That is, if Bitfinex deducted crypto and fiat currency worth a total of, say, 1000 USD from a customer's account, the customer was credited with 1000 BFX. At the then-market value of below 20 cents per BFX token, this effectively meant Bitfinex caused damages of more than 800 USD to the customer. Using Bitfinex's own Bitcoin exchange rate of 604.06 USD at the time, this corresponds to more than 1.32 BTC.

Fast forward to 2022: The hackers were caught, and 95k BTC were recovered. I firmly believe that customers like the one in the example above own at least their proportional share of these BTC (including the forks). While I promptly wrote to both Bitfinex and the DoJ in 2022 to register my claims, neither responded. Last week, I discovered - purely by chance - that the DoJ plans to transfer the entire recovered 95k BTC directly to Bitfinex, leaving users empty-handed [2] p.19. In particular, Bitfinex does not intend to compensate the users affected in 2016, because "iFinex believes that it is the sole victim with sustained financial losses from the hack" [1] p.4.

United States Attorney Matthew M. Graves' justification for this decision reveals several deeply troubling issues:
1. In a glaring contradiction, he states that "the government's position is that there are no victims of the offenses of conviction" [1] p.5 and therefore users have no right to restitution [1] p.5 Footnote 2. Yet simultaneously, the government requests that the seized cryptocurrencies be returned as in-kind restitution to Bitfinex [2] p.19, effectively blocking users from accessing their rightful property.
2. He bases this position partly on the fact that "Defendant Ilya Lichtenstein and Defendant Heather Rhiannon Morgan .. maintain that the only potential victim for CVRA or MVRA purposes, if any, is Bitfinex." [1] p.2. It's strange that the hackers' opinion is being considered in determining who legally qualifies as a victim.
3. His presentation of the BFX token situation is fundamentally misleading. He claims ".. customers holding BFX tokens then had the choice of .. (2) redeeming their BFX tokens for a cash payment from Bitfinex, at a rate of $1 per BFX token .." while omitting that this option only became available many months after the hack and BFX distribution [1] p.3,4. Even more egregiously, he states: "In short, according to iFinex, all customers on VICTIM VCE's platform immediately following the hack had the same options: sell their BFX tokens .. back to VICTIM VCE for cash" [1] p.4. This is demonstrably false. In the immediate aftermath of the hack, BFX tokens traded below 20 cents [4], and Bitfinex made no cash offer (the BFX token was created precisely because Bitfinex lacked funds to compensate for the theft). The United States Attorney attributes these statements to iFinex - either he fabricated this or Bitfinex provided false information.
4. His claim that "The government has attempted to locate those victims, including by requesting a list of all accountholders from VICTIM VCE, but such efforts have been unsuccessful" [1] p.6,7 is absurd. Bitfinex could easily have notified its former customers via email. While Bitfinex's reluctance to do so is unsurprising, it's troubling that the United States Attorney apparently made no effort to compel such notification. Despite my 2022 communications to both the DoJ and Bitfinex, I received no notification and only learned about the planned transfer by chance.

Also concerning is the current timeline: Bitfinex victims are required to "submit a statement by no later than November 12, 2024" [5], despite the announcement apparently only being made at the end of October. This extremely short deadline appears deliberately prohibitive, especially given that many affected users likely haven't even learned about this opportunity yet - a direct consequence of the aforementioned inadequate notification practices. Notably, [5] only mentions impact statements, while [1] had announced giving users an opportunity to advance potential claims for victim rights and/or restitution [1], p.1 and p.9.

It's crucial to note that the stolen BTC were never Bitfinex's property. According to Bitfinex's own Terms of Service at the time, "all bitcoins in your Multi-Signature Wallets belong to and are owned by you."

Given these circumstances, I have engaged legal counsel last week, and we are currently preparing legal action. If you were also affected by the 2016 Bitfinex hack, I encourage you to contact me via forum PM for coordinating our strategy and potential joint legal action.

References:
[1] https://docs.dbnews.com/u/Bitfinex-Victim-Rights-Notification.pdf
[2] https://www.tbstat.com/wp/uploads/2024/10/show_temp-1.pdf
[3] https://www.bitfinex.com/posts/129
[4] https://www.bitfinex.com/posts/494
[5] https://www.justice.gov/usao-dc/2016-bitfinex-hack

HPt

Posts

Merits