Bitfinex’s six-year trace ran through records that banks keep
Investigators followed bitcoin stolen in 2016 to a $3.6 billion seizure in 2022 because the ledger never forgets. The decisive links sat at regulated firms, so banks’ own records of crypto-linked activity need to be built to be read years later.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On February 8, 2022, the Justice Department announced the arrest of two people in New York on charges of conspiring to launder cryptocurrency stolen in the 2016 hack of Bitfinex, a virtual currency exchange. It also announced the seizure of about 94,000 bitcoin, then worth roughly $3.6 billion, which it called the department’s largest financial seizure to date. According to the department’s filings, investigators traced the stolen funds through thousands of transactions on the bitcoin blockchain, across many laundering techniques, to accounts linked to the defendants. Some funds had passed through accounts at virtual currency exchanges and other financial services. Agents recovered the bitcoin after gaining access to files holding private keys. IRS Criminal Investigation, the FBI and Homeland Security Investigations worked the case.
A common view of cryptocurrency held that it was anonymous and so suited to crime. The Bitfinex case showed the other side. The bitcoin ledger is public and permanent. It does not record names, but it records every movement of funds, and anyone can analyze it at any time. Investigators with patience and better tools could return to 2016 transactions in 2022 and follow them. Banks and credit unions see a growing share of their customers’ money pass to and from crypto platforms. For them, the case carried a practical message about their own data. We look at three parts: what the trace relied on, where it met regulated institutions, and what a bank’s records need to hold.
What the trace relied on
Blockchain tracing combines the public ledger with analysis that groups addresses likely controlled by the same party and follows funds through attempts to obscure them. Those attempts include splitting amounts across many addresses, passing funds through mixing services, converting between currencies and moving across blockchains. Government investigators and commercial analytics firms had refined these methods for years. They are probabilistic. A clustering result is a strong inference, not proof, which is why investigators combine it with records from institutions, devices and accounts.
Time favored the investigators. A launderer has to avoid every mistake, indefinitely, because the record stays. An investigator can wait for a new technique, a new lead or a seized device. Methods unavailable in 2016 could be applied to 2016 transactions. That asymmetry is unusual in financial crime. Most evidence decays: records are purged, people forget, systems are retired. On a public ledger, the trail does not.
Where it met regulated institutions
Stolen crypto is of limited use until it becomes ordinary money or goods. That conversion usually happens at exchanges and other virtual asset service providers. In the United States, many of these firms are money services businesses that must verify customers, keep records and file suspicious activity reports. When laundered funds touched such an account, the ledger trail met a name, an address and a bank account. Those were the joins that turned a chain of pseudonymous addresses into a case.
Banks sit one step further out. They rarely see the blockchain. They see wires and card payments to and from exchanges, deposits that follow crypto sales, and customers who act as informal brokers for others. A bank’s record of those flows, its due diligence on the customer and its alert history are the next links in the chain. An investigator who traces funds to an exchange account, and from there to a bank transfer, will eventually ask the bank what it knew.
That is also where a bank adds detection value. Combining a customer’s transfers to exchanges with information about the on-chain activity behind them can show patterns that neither view reveals alone. Examples include rapid round trips, funds arriving from addresses linked to hacks or sanctioned services, and customers whose crypto activity bears no relation to their stated business.
What a bank’s records need to hold
The first need is visibility of exposure. Many banks in early 2022 could not say which customers transacted regularly with crypto platforms, how much, or with which ones. That segmentation can be built from existing payment data by maintaining a list of exchange counterparties, their account and routing details, and their card merchant identifiers. It belongs in the customer risk model alongside other risk attributes. The list needs an owner and a refresh cycle, since platforms open new banking relationships, change processors and close often.
The second is a defined route to on-chain analysis. Few banks need an in-house blockchain team. Investigators do need a way to examine a suspicious transfer in context, through a vendor tool, a shared service or an escalation path to a specialist. The results, including addresses examined and conclusions drawn, should be stored in the case file in structured form, not pasted as screenshots.
The third is records built to be read later. The Bitfinex case was charged nearly six years after the theft. Bank Secrecy Act records generally must be kept for five years, and many institutions keep some longer. The issue is less the retention period than whether records can still be found and understood when someone asks. A case file that records why an alert was closed, which exchange was involved, and what the customer said is useful years later. A disposition reading “reviewed, no concern” is not.
These capabilities carry limits. Analytics vendors attribute addresses with varying confidence, and some assets and techniques defeat tracing. A risk score from a provider is a model output and should be validated and documented like other compliance models. Banks also need to avoid treating every customer who buys crypto as suspect. Many uses are lawful, and blanket de-risking pushes activity to less transparent channels. Analytics should inform an investigator’s judgment, not replace it.
With hindsight
The two defendants pleaded guilty in 2023 and were sentenced in 2024. In early 2025 a federal judge ruled that the bulk of the seized bitcoin should be returned to Bitfinex. Blockchain tracing became routine in large cases, including the FBI’s attribution of the February 2025 theft of about $1.5 billion from the exchange Bybit to North Korean actors. Policy moved too. Treasury sanctioned the Tornado Cash mixing service in 2022; an appeals court ruled against parts of the designation in late 2024, and Treasury lifted it in 2025. The GENIUS Act, signed in July 2025, brought payment stablecoin issuers under Bank Secrecy Act obligations. By this point in 2026, banks with meaningful crypto exposure generally monitor it as a customer risk attribute and have access to on-chain analysis. Smaller institutions vary widely, and many still could not reconstruct a crypto-linked case from their own files.