The Untold Story Of How A YouTube Rapper Became A Suspect In A $4 Billion Bitcoin Fraud

Forbes reveals how a self-styled marketing guru from small-town America and her husband became heist suspects – as an analysis suggests the couple still has access to stolen bitcoin, including some that was transferred through a Russian darknet website.

BY CYRUS FARIVAR, DAVID JEANS AND THOMAS BREWSTER

On her wedding day in November, Heather Morgan was center stage, leaning back on one arm, holding a microphone and gyrating on the ground. Surrounded by a semi-circle of people waving gold palm leaves, with a warped bass line echoing through the Los Angeles event space, she rapped to friends and family gathered for her ceremony.

Her husband of just a few hours, Ilya Lichtenstein, looked on. The pair had billed the event as “all about celebrating your real self and our love” in a promotional YouTube video. But Morgan’s performance, in the guise of her rapping alter ego Razzlekhan, like the couple’s celebration that day, turned out to be a high water mark of their life together. Just three months later, they would be arrested on federal charges of conspiring to launder a multibillion-dollar trove of bitcoins stolen from cryptocurrency exchange Bitfinex in 2016. The couple was not accused of the theft itself.

On their wedding day, November 13, the pair knew law enforcement agents were investigating them. When they were arrested February 8, the Justice Department touted it as a “major blow to cyber criminals looking to exploit cryptocurrency” and said it had recovered bitcoins valued at $3.6 billion, its largest financial seizure ever. Media reports centered on Morgan’s bizarre Razzlekhan persona – a YouTube creation in which she rapped and pontificated about topics ranging from success and money to food and travel. Her relationship with Lichtenstein, 34, added spice to the mix, with some outlets labeling them the Bonnie and Clyde of cryptocurrency.

Behind the headlines and telecasts, what remained a mystery was how Morgan, 31, a woman of humble beginnings in rural California, where she once described picking walnuts and cleaning houses, allegedly came into unimaginable wealth — a sum that grew from $70 million to more than $4 billion as the price of Bitcoin soared — and then became an object of international ridicule.

With global interest growing in the case — Netflix and Forbes announced separate documentaries days after the arrests — a tragic portrait has emerged of Morgan. In interviews with 18 people who knew the couple, some of whom shared text messages, audio, video and photos, Forbes found that Morgan was determined to make herself a Silicon Valley thought leader and launched her own startup, a marketing company called Salesfolk. That was before she met Lichtenstein, a man who seemed to bring out her worst instincts, according to people who knew her.

Morgan was drawn to “guys who were just above her level, who she could leverage for her own career,” says Haley Hidalgo, who said she was once Morgan’s best friend and employee. “I think Ilya just happened to be smarter than the rest of them.”

Federal prosecutors said in a February court filing that the couple still has access to 25,000 bitcoins, worth approximately $1 billion today. Analysis provided to Forbes by Elementus, a blockchain search engine that tracks bitcoin transactions, has found that the pair were able to shield the unseized money through a complex series of crypto transfers. Max Galka, Elementus’ CEO, said the bitcoins were moved across more than 20,000 transactions, indicating that some form of automation software was used.

Galka told Forbes that some of the unseized bitcoins were transferred through the Russia-based darknet market Hydra. “It’s the largest darknet market in existence,” Galka says. “It is highly unlikely law enforcement has the ability to trace these funds further.” According to Elementus, the last known movement of the unseized cache occurred on January 25, shortly before the couple’s arrests at their Wall Street apartment.

Where those remaining riches may end up is an open question. Nearly four months after Morgan’s wedding performance, her unwavering devotion to the man some called her “Crypto Clyde,” forged by love and misadventure, could be seen fraying amid discussion of what prosecutors say are “possible resolutions short of trial,” otherwise known as a plea bargain. Attorneys who initially represented both Morgan and Lichtenstein wrote in a February 11 filing to the court that the government’s alleged proof makes “unsupported, conclusory leaps,” and adds that prosecutors’ claims are “especially flimsy as to Ms. Morgan.” After initially sharing Lichtenstein’s attorney, Morgan hired her own on February 28.

Both Morgan and Lichtenstein are next set to appear on March 25 for a status hearing. Lichtenstein’s attorney, Samson Enzer, did not respond to comment requests. Zak Sawyer, a spokesperson for Morgan’s new attorney, Marshall Miller, declined to comment for this story.

As a kid in Tehama, California, a town of 400 people, two bus stops, two churches, and not much else, Morgan was keen to escape. “Growing up, I didn’t have a lot of friends, and it was really hard because no one believed in me, supported me, understood me, and no one wanted to do the things I wanted to do professionally,” she said in a YouTube video posted in January 2021. “The whole experience was a nightmare.”

Morgan described being “bullied mercilessly,” and multiple classmates told Forbes that Morgan was picked on for her slight lisp. She transferred to a bigger high school in Chico, 30 minutes away by car. She said a teacher there also discouraged her ambition. “You’re a big fish in a small pond, but if you go to the ocean, you might drown,” Morgan recalled the teacher saying. “I remember thinking …‘This isn’t a pond, this is a mud puddle, but the ocean, I’m a shark, I belong in the ocean!’”

“I think she wanted to tell some story that she was a survivor.”

Years later, people living in Morgan’s northern California hometown were surprised to learn of the criminal complaint against her — and the details of her life story that have emerged since it was filed. “It’s quite a story,” Tehama mayor Robert Mitchell told Forbes, standing in front of his house.

People who knew Morgan during her formative years say her intelligence made her stand out. “Even among nerds, Heather was considered pretty nerdy,” a former high school classmate now known as Kitty Davies, said in a TikTok video. She went on to describe Morgan as a “‘Daily Show’ liberal.” “She was one of those girls who took really meticulous notes,” Davies said.

But Morgan distinguished herself. She studied Japanese, which led to an exchange program in Japan. It was something she believed would fulfill her “dream of getting out [of rural California] and going far far away,” she wrote later.

After graduating with an economics degree from the University of California’s Davis campus in the summer of 2011, Morgan lived in Hong Kong, where she worked at the Hong Kong University of Science and Technology, running seminars for students about American culture. By the time she arrived in Cairo in 2012 for a postgraduate degree in international economics, her childhood dream of escaping small-town America had become reality.

With her sense of adventure, Morgan attracted a circle of friends, and sometimes joked that she was a “narcissist,” according to Hidalgo, who attended the American University of Cairo with her. During this time, Morgan was an avid fan of the YouTube satirical rapper Lil Dicky and the comedy trio fronted by Andy Samberg, The Lonely Island. At times, without warning, Morgan would break into her own freestyle rapping. “I thought, here’s an interesting character,” Hidalgo says. “I would consider her my best friend for several years.”

Morgan sometimes said things that didn’t add up, according to Hidalgo and others. Morgan often asserted that she was an economist, and in blog posts signed off as “economist and writer.” Hidalgo thought that was strange. Beyond a bachelor’s degree in economics, Morgan didn’t work as an economist. Morgan also claimed to be writing a book about the gay community in Cairo. Then there was the question of why she told people she was Turkish, claiming that her real name was Heather Reyhan. (It’s Heather Rhiannon Morgan.)

Morgan became a linchpin in the LGBTQ party scene, according to a friend she met in Tunisia, who said “it was a bit underground.” The gay community faces harsh oppression in Egypt, but Morgan organized parties and registered a domain, ComeOutCairo.com, though the website never materialized.

Then, one day in early 2013, Morgan walked into Hidalgo’s living room in Cairo and announced that she was returning to California. “I’m not making money,” Morgan said, according to Hidalgo. “I need to make money.” (Despite claiming on LinkedIn that she earned a master’s degree from the American University in Cairo, a spokesperson for AUC told Forbes that Morgan left the university after one semester and never earned her degree.) Morgan was seen off by a small crowd of friends. “There were like eight cars, so all her friends went all together to say bye to her,” said the friend she met in Tunisia.

Morgan landed in the Bay Area, and set about trying to build bridges to entrepreneurs. “I was forsaking my identity as an expat in emerging markets … to sink my teeth into a new kind of challenge: Tech Startups,” she later wrote. She spent weeks and months sleeping on friends’ couches with few belongings and “practically lived off Chinatown dim sum,” she wrote in an online posting.

Eventually, she met a young Jordanian entrepreneur named Hussam Hammo, who had been accepted to the 500 Startups accelerator program to launch a gaming company called Tamatem. Being an American woman with a basic knowledge of Arabic, Morgan was the perfect person to pitch his company to investors, Hammo says. She told him she was a practicing Muslim and fasted during Ramadan.

While Hammo couldn’t pay her – 500 Startups only gave him $37,000 and three months to get Tamatem off the ground – Morgan was introduced to a coterie of investors and entrepreneurs without the trouble of starting her own company.

A month after joining the accelerator, she appeared in a promo video for 500 Startups, entitled “Thrifty Startup,” a parody of the Macklemore hit “Thrift Shop.” In the video, would-be startup founders rap about how they’re going to “raise some funds” and are “looking for some millions.”

A fellow 500 Startups member, Talvinder Singh, who shot much of the video at a Mountain View condominium, said that at one point during filming Morgan suddenly stripped to her bra and underwear for no discernible reason. “Everybody was unsure how to react,” he told Forbes. “For me, it was a culture shock.” Another batch member, who asked to remain anonymous, added: “She made sure to be in the center of [the video].”

Once 500 Startups concluded in July 2013 with a series of investor meetings in New York, Hammo returned to the Bay Area with the intention to continue working on Tamatem with Morgan. But after days of trying unsuccessfully to contact her, Hammo was told by colleagues that she had moved to Brazil and married another 500 Startups member, Bruno De Souza, who had co-founded an app that allowed users to track their pets. “It was mind-boggling,” Hammo says.

In an email to Forbes, De Souza said he had an “intense relationship” with Morgan that began during their few days in New York, but added that the marriage was mainly intended to secure a visa so she could stay in Brazil and work on his pet-tracking startup.

The relationship soon fell apart. Hidalgo says Morgan told her in October 2013 that she was forced to “flee” Brazil because the relationship had become “abusive.” In a message sent to another friend and shared with Forbes, Morgan wrote she had returned to California after finding out that De Souza was “cheating and many other things.”

De Souza denied being abusive toward Morgan, or cheating on her, and said that she was “depressed.” He believed she had conjured a story to explain why she was leaving Brazil. “I think she wanted to tell some story that she was a survivor,” he said. Court records obtained by Forbes show that Morgan initiated the divorce in January 2014 and the split was finalized eight months later.

At the end of 2013, Hidalgo flew to San Francisco to visit Morgan. The divorce papers hadn’t been filed, but Morgan had already begun dating someone else. At a dinner, Morgan introduced Hidalgo to the man standing awkwardly next to her. “This is Ilya,” Hidalgo recalled Morgan saying. “He’s a black-hat hacker.”

With thick dark hair and a creased smile, Lichtenstein was seen by some of his peers as an outcast with a mischievous bent. “I think he was the first guy I saw who was as weird as [Morgan],” said one of Morgan’s friends.

Born in Rostov, Russia, and raised just outside Chicago in Glenview, Illinois, Lichtenstein had an interest in history and video games. One former classmate recalled that during middle school Lichtenstein would borrow pens from him. “One day he gave me a blank piece of paper and asked me to sign my name on it,” the classmate said. “I did so, and then he went and wrote out a contract saying that I agreed to bequeath my pen to him.”

It was a small-scale version of the type of calculating that would shape his career as a self-described hacker. In 2009, Lichtenstein described himself as a “huge geek” who had been the “captain of math team and quiz bowl … and even managed to date a couple girls who were way out of my league.” After graduating from the University of Wisconsin, Madison, with a degree in psychology, Lichtenstein moved to California.

“They probably did not have a plan for this when they [allegedly] stole the funds and hadn’t really thought it through.”

Like thousands of starry-eyed arrivals to Silicon Valley, Lichtenstein was immediately enamored. “Two months ago I dropped what I was doing, sold everything I owned, said goodbye to my friends and girlfriend and moved from the Midwest to San Francisco,” he wrote in September 2010. “It was probably the best decision I ever made. Not that I was unhappy before, but it’s so … different here.” Also like other arrivals, he seemed focused on riches. “I have a simple rule for dealing with incoming email,” he wrote on his blog, influencehacks.com. “If you send me an email and I don’t know you, I need to know in about 15 seconds how reading this email is going to make me more money. If, after 15 seconds of reading, I don’t know that, I move on to the next email.”

Lichtenstein launched a flurry of online ventures that included a dating site and a site that sold brain supplements. He worked on a hacking tool to circumvent the security tool CAPTCHA. His most successful project was MixRank, a data-driven-marketing startup, that took off after he attended Y Combinator in 2011 and received funding from billionaire Mark Cuban. Three of his Y Combinator batch mates told Forbes that he was kind, shy and happy to share his marketing expertise.

Lichtenstein first met Morgan in the summer of 2013, when he served as a mentor for 500 Startups and she was working with Hammo on Tamatem. During a talk at 500 Startups in June, he discussed his experience starting a company. “Listening to @ilyabot explain how to go from being ‘world’s worst SEO’ to 10x your traction at @500startups,” she tweeted during his seminar.

Hammo recalled Lichtenstein appearing in New York during the 500 Startups demo weekend in July 2013 — the same weekend Morgan and De Souza started their relationship — when the entrepreneurs were out at a bar to celebrate. Hammo says Morgan appeared drunk and that he saw Lichtenstein trying to coax her out of the bar. When Hammo asked what was happening, Morgan said everything was OK, and then left the bar with Lichtenstein. “I did not have a good feeling about him,” Hammo says.

Once the two started dating at the end of 2013 — after Morgan returned from Brazil — Morgan moved out of her shared house and into Lichtenstein’s high-rise apartment in San Francisco, with a view of surrounding skyscrapers. On social media, she posted images of them flying first-class to Hong Kong, Panama and Mexico.

She launched her own startup, Salesfolk, which offered companies cold-email marketing campaigns, a skill Morgan homed in on after securing meetings with investors and consultants for Tamatem. Lichtenstein served as an advisor. “She is a singular copywriting force, uniquely able to upend the way you think about customer acquisition and elevate your business to the next stage of its growth,” Lichtenstein wrote on LinkedIn when she launched the company in March 2014. “Talk to her now.”

Morgan hired Hidalgo as her first employee. Working remotely, Hidalgo was paid $1,300 a month — a decent salary for Cairo — to help with email campaigns and organize client meetings. Hidalgo says Morgan created at least two fictitious employee profiles on LinkedIn to give the appearance the company was bigger than it was.

As Morgan’s relationship with Lichtenstein grew, she often used MixRank’s office space on Townsend Street in San Francisco, a former MixRank employee recalled, and would consult Lichtenstein on running Salesfolk. One morning in 2015, Hidalgo received a call from Morgan, telling her that after consulting with Lichtenstein, Morgan was firing her because “business was going slow.”

Hidalgo was among several friends who cut off contact with Morgan around this time. Liechtenstein also began to withdraw from his professional responsibilities. In May 2016, he abruptly left MixRank. It was baffling, said a former employee, considering the upward trajectory of the business. “We were all trying to figure out, why did he walk away now? We were doing really well. Our revenue was jumping pretty quickly,” the person said. MixRank’s other co-founder, Scott Milliken, didn’t respond to requests for comment.

As it turned out, the couple would become involved in something way beyond internet marketing.

On August 2, 2016, Bitfinex, one of the world’s largest cryptocurrency exchanges, announced that it had suffered a security breach and “some of our users have had their bitcoins stolen.” Over the following month, the British Virgin Islands-registered exchange found that a hacker, or hackers, had stolen 119,754 Bitcoins, then valued at around $66 million.

The Justice Department later found the theft had been pulled off by taking advantage of a security feature called multi-sig, which requires at least two parties — in this case, either Bitfinex, the owner of the bitcoin or a third-party wallet provider known as BitGo — to sign off on any transaction. Bitfinex had said it was “impossible for our users to lose their bitcoins due to us being hacked or stealing them.” But Mike Belshe, the CEO of BitGo, Bitfinex’s wallet provider, later tweeted that “BitGo was not hacked or breached in the incident. Bitfinex had a major breach across multiple systems and people.” Belshe declined to elaborate on his tweet for Forbes.

In hindsight, it appears that Morgan might have left a trail of clues. In 2017, Morgan claimed during a Salesfolk presentation that her company had generated $64.7 million in revenue during 2016, according to slides of the presentation seen by Forbes. In what could be a coincidence, that was a figure similar to the value of bitcoins, around $66 million, spirited away from Bitfinex.

To Hidalgo and other former Salesfolk employees who spoke to Forbes, such a figure wasn’t credible for a company that seemed to have no more than five employees at any time and paid salaries between $10,000 and $30,000. One former intern told Forbes that they were terminated suddenly in 2016 because the company couldn’t pay them. Two years later, Morgan told a cryptocurrency exchange that Salesfolk earned “around $8,500 or less per contract/invoice,” according to prosecutors.

Federal investigators reconstructed and later cited Morgan’s movements around this time. In 2019, Morgan posted to social media her location at a time when the couple were allegedly laundering the bitcoins. According to an IRS affidavit, Morgan indicated that she was in the Ukrainian capital of Kyiv in August and September 2019. According to Lichtenstein’s seized digital files, authorities were able to match tracking numbers of “packages from darknet vendors” sent to them from Russia during this period.

By this time, much of Morgan’s social media posts centered on Morgan’s rapper persona, Razzlekhan, with YouTube music videos appearing monthly. “More fearless and more shameless than ever before, she’s taking on everyone from big software companies to healthcare to finance bros,” her website blared. Based on her claim to be an economist, Morgan also started writing blog posts on Forbes as a contributor, alluding to her skills in her bio: “When she’s not reverse-engineering black markets to think of better ways to combat fraud and cybercrime, she enjoys rapping and designing streetwear fashion.”

As the price of Bitcoin rose, Morgan’s rapping remained prolific. In one song cited by prosecutors, she rapped, “Spear-phish your password / all your funds transferred.” In another, called “Menace to Society,” she described herself as “the catfishing queen.”

But time was running out for the couple. Their undoing appears rooted in the thorny problem of how to cash out a trove of stolen bitcoins — akin to selling a stolen Matisse. According to the government’s affidavit, Lichtenstein and Morgan took years, and multiple steps, to allegedly launder the ill-gotten bitcoins and appropriate ownership. “The more you spread it out, the larger the surface is through which you can get caught,” Galka, the Elementus CEO, told Forbes in an email. “They probably did not have a plan for this when they [allegedly] stole the funds and hadn’t really thought it through.”

It seemed the couple weren’t living as if they had access to billions of dollars, either. According to prosecutors, Lichtenstein’s small crypto startup, Endpass, received an $11,000 check via the Paycheck Protection Program, the federal program designed to save jobs in the early days of the pandemic. Just weeks later, bitcoins linked to the hack were used to buy, among other things, a $500 Walmart gift card, on which purchases were made under Morgan’s own name, according to the IRS affidavit.

Lichtenstein and Morgan appeared to be two sides of the same coin. Bound by intelligence and love, they complemented each other’s skills. When the feds raided their Wall Street apartment in January, they found fake passports, burner phones, $40,000 in cash and evidence the couple was planning to flee to Ukraine or Russia.

Now, Lichtenstein sits in a jail cell and Morgan is under house arrest. A list of her achievements after escaping small-town America and before her indictment can still be found on her LinkedIn page. They include her degree from UC Davis, attending American University of Cairo, Salesfolk, Razzlekhan and writing for Forbes as a contributor, among other things.

At the top of the page, Morgan has left a thought. “With words and software,” she wrote, “you can write your own destiny.”

Sue Radlauer and Itay Zehorai contributed research.

MORE FROM FORBES

MORE FROM FORBESHighest-Paid NFL Players 2021: Two Star Quarterbacks Post Records On And Off The FieldBy Brett Knight
MORE FROM FORBESHow Much Money Are At-Home Covid-19 Tests Bringing In?By Amy Feldman
MORE FROM FORBESHow HCA Healthcare’s ‘Conservative’ Covid Strategy Reaped DividendsBy Katie Jennings
MORE FROM FORBESHome On The RoadBy Michael del Castillo
MORE FROM FORBESWar, From The Point Of View Of A Ukrainian Teen, Streams Live On TikTokBy Alexandra S. Levine