Meet the crypto 'Bonnie and Clyde': A TikTok rapper who calls herself the 'Crocodile of Wall Street' and her husband 'Dutch'. We look at their alleged links to the Bitfinex hack.

• A married couple in their 30s face charges of laundering bitcoin worth $4.5 billion from the 2016 Bitfinex hack.
• Ilya Lichtenstein and Heather Morgan behaved like people in a spy novel, US prosecutors allege.

A couple in their 30s, referred to as the crypto "Bonnie and Clyde," have quickly come under the spotlight after being accused of conspiring to launder almost 120,000 bitcoin worth $4.5 billion taken in the 2016 Bitfinex hack.

Ilya Lichtenstein, a Russian-American who goes by the nickname "Dutch," and his US-born wife Heather Morgan were arrested in Manhattan this week. The US Department of Justice seized bitcoin worth $3.6 billion, recovering most of what was lost in the cyberattack.

Morgan, who calls herself the "Crocodile of Wall Street," raps on TikTok under the name Razzlekhan, and is a (now former) Forbes contributor who once wrote an essay on how businesses can shield from cybercriminals.

@realrazzlekhan A lil #freestylerap for #moneytok about #HODL & #gamestop by a former #economist ‍♀️ #visionboard #albumcover #gamestockstock #robinhood ♬ original sound - Razzlekhan ‍♀️

Lichtenstein's presumed Twitter account has frequent posts about Web3 and cryptocurrency, while his LinkedIn account lists roles as an advisor to a blockchain startup and an investor in similar projects.

Where are the couple accused of laundering money from?

Hong Kong-based Bitfinex said in August 2016 that hackers had taken 120,000 bitcoins, worth roughly $70 million at the time.

The US authorities believe the intruder carried out more than 2,000 unauthorized transactions and ultimately sent the bitcoin collected to a wallet held by Lichtenstein. They have not accused the couple of carrying out the cyberattack.

About 25,000 bitcoins were transferred out of Lichtenstein's wallet, some to accounts held by him and his wife, the authorities said in court filings. The remaining 94,000 continued to be held in the wallet originally used after the hack.

Discovery of the alleged trail

Special agents with search warrants for the couple's online accounts retrieved files from a Lichtenstein-controlled account that held the private keys for the original wallet.

Finding the keys was a crucial step. It possibly revealed the recipient's wallet address, helping the investigators work out the laundering scheme. This enabled them to recover 94,000 bitcoin.

The DOJ said the couple engaged in several types of virtual-currency transactions, including NFT purchases. But their OpenSea accounts now appear to have been deleted.

How did the duo allegedly 'launder' bitcoin?

Lichtenstein and Morgan used multiple sophisticated methods, the authorities allege.

The couple created fake accounts, and used automated computer programs to carry out multiple transactions, depositing the funds with several crypto exchanges to make them hard to track, the DOJ said in its charges. They also used US-based accounts to make their activities seem legitimate, it alleged.

A new 34-page court filing Thursday alleged the couple attempted to conceal their role in laundering bitcoin by establishing new identities.

Lichtenstein and Morgan spent a month in Ukraine in 2019, prosecutors said, where their activities "at times appear pulled from the pages of a spy novel." They are thought to have been preparing for life in Russia, as Morgan was learning the language.

A January 5 search of the couple's New York apartment found cash worth $40,000, over 50 electronic devices, two hollowed-out books, and a bag labelled "burner phone," they said.

The authorities believe they have accessed Lichtenstein's cloud storage account. The encrypted files there have a spreadsheet of various accounts, and additional wallets the authorities haven't legally been able to seize.

"Several of these files include variations of the word 'dirty' in their names, such as 'dirty_wallet.dat,'" the filing said.

Another discovery was a file called "passport_ideas," holding links to various darknet vendor accounts offering passports or ID cards for sale.

Lichtenstein and Morgan face charges of conspiracy to commit money laundering and to defraud the US, carrying a combined sentence of 25 years. They will remain in custody until a February 14 trial.

Anirudh Bansal and Sam Enzer, reported to be the couple's lawyers, didn't respond to Insider's request for comment.