The Rabbit Hole Beneath the Crypto Couple Is Endless

“I’m in shock,” said Cavier Coleman, a New York-based photographer and artist, the day after Heather Rhiannon Morgan was arrested. “She’s a great person.” The two had been friends for nearly five years; he remembered that she would bring him bags of pecans from her grandmother’s tree, and was passionate about making sure her friends were treating the coronavirus seriously.

Earlier this week, federal prosecutors accused Morgan, 31, and her husband, 34-year-old Ilya Lichtenstein, of conspiring to launder around $5 billion in stolen bitcoins. Within hours, they had achieved global notoriety as the embodiment of everything lurid and grotesque about the recent mania for cryptocurrencies. The sheer scope of the alleged fraud, and Morgan’s bizarre online presence as maker of some of the most cringeworthy music ever recorded, positioned their story as a perfect synecdoche for everything anyone doesn’t like about an attention economy in which anything can be—and is—financialized.

There’s still a great deal we don’t know about this case, and about the couple who sit at the center of it: the precise extent of their alleged involvement in a massive criminal scheme, the exact nature of that scheme, who else may have been involved in it, just what they may have made off with, and, above all, what they have to say about it.

What we do know is that there’s a great deal of dissonance here. Morgan, in particular, portrayed herself as a renaissance woman, an entrepreneur/economist/influencer/“surreal artist”/comedian/self-described “cringe” rapper named Razzlekhan, who makes music “for the entrepreneurs and hackers, all the misfits and smart slackers”/writer/advice-giver, making her a recognizable type of figure with a seemingly endless online presence. In addition to all of those things, though, the Department of Justice alleges, she was, along with Lichtenstein, one of the most prolific money launderers in history.

Like many people of her generation, for whom online notoriety is often linked to personal and professional achievement, Morgan has posted hundreds of videos and thousands of posts across nearly every social media platform, ranging from earnest self-help tips for college students who believe they selected the wrong major to a weekslong extended promotional rollout across Twitter, TikTok, and YouTube for “GILFalicious,” a rap song about becoming, in the future, a “grandma I'd like to fuck.” Given this week's indictment, the seemingly transparent nature of her social media presence, and the fact that she regularly talks about always living life “authentically” and without fear, people—including Motherboard reporters—have understandably been trying to find clues in her posts that would suggest the couple were criminal masterminds.

A Motherboard review of government filings, online databases, public documents, and an exhaustingly extensive online record that includes hundreds of articles in Inc. and Forbes and a video of Lichtenstein eating cat food, though, along with conversations with more than a dozen people who did business with or were close to the couple, does not contain any obvious clues that these people were sitting on a trove of money larger than any ever seized by the United States Department of Justice.

What turns up is something like the event horizon of a black hole. The DOJ, the press, and the voluminous postings the couple made online all present detailed narratives; the sheer volume of information, though, makes it difficult to unpack exactly how the alleged scheme played out, what the motivation for it was, and the exact role the couple played in a storyline that has developed in the crypto world for years. Most of all, there’s a dissonance between the couple's public personae and their alleged crimes. This of course isn't rare; many people are surprised when their friends commit crimes. But it's hard to know what to make of an alleged prolific money launderer who eats cat food, or one who raps about her glow-in-the-dark T-shirts that say “make me cum or make me ca$h.”

“I have all kinds of friends at different points in their life,” Morgan said in one of her videos. “I have my billionaire software entrepreneur friends, and then I also have some other friends that, you know, are really nice, good, smart people.”

Coleman said that while Morgan was always dressed well and had a clean little apartment and a small art studio, he got the impression that she was well-off but not rich, and perhaps supported by her family. 

“I’m not trust fund; my parents didn’t have a lot of money,” Morgan said. “My dad was a biologist for the government and my mom was a high school librarian. I’ve also been homeless and totally broke and homeless multiple times. Money in my mind comes and goes. Sometimes you have it and sometimes you don’t. Nothing in this life is certain … you have to stay agile.” (Her parents did not reply to requests for comment.)

Coleman, who said that in retrospect he was glad he never sold the couple a painting, remembered an art show last year where he was exhibiting; he met Lichtenstein for the first time there.

“He didn’t say much, but he looked at everything,” said Coleman. “Very observant. Very curious—not standoffish, but had a wall up. Not bad or untrustworthy, but… something. I couldn’t explain.”

“I can completely see how Ilya—the guy—was actually doing that,” said one source who knew the couple. (They were granted anonymity so as to be able to speak candidly.) “He was a software person and kind of a genius.”

This source was, like Coleman and others who knew them, shocked at Morgan’s arrest. “I can’t really see her being in the middle of something like that,” they said. 

What “that” is is worth defining precisely: The couple is not accused of stealing the nearly 120,000 BTC worth around $5 billion that they allegedly controlled; they’re charged with conspiracy to launder it. 

Adding to the broader intrigue of the story, the Bitcoins that the couple is accused of controlling and attempting to launder are the ill-gotten proceeds from one of the most infamous hacks in cryptocurrency history. In 2016, Hong Kong-based Bitfinex was one of the biggest cryptocurrency exchanges in the world. On Aug. 2 of that year, it notified users that nearly 120,000 BTC, worth some $60 million at the time, had been stolen from the platform. The fallout was immense, as the exchange elected to reduce the accounts of every customer on the platform by more than 30 percent to average out the loss and credited them with a new token called BFX, which have now all been redeemed. 

But that turned out to just be the beginning of the story. All of the proceeds from the hack ended up in a single cryptocurrency wallet initially, and observers have tracked the funds' movements over the years thanks to the transparent nature of the blockchain. The vast majority of the stolen Bitcoins have remained in that initial wallet, without many updates. In 2019, Bitfinex announced that investigators had recovered 27 BTC from the hack. Meanwhile, the value of the stolen Bitcoins skyrocketed since the hack until they were worth billions and not mere millions. 

An official answer was never given for how the hack occurred, although much analysis has centered around the multi-signature wallet setup that Bitfinex created with a company called BitGo. At the time, BitGo denied being compromised in any way. Even after the arrests of Morgan and Lichtenstein, we don't have a clear answer. In a statement of facts, an IRS investigator stated that “a hacker breached [Bitfinex's] security systems and infiltrated its infrastructure,” which is at least seeming confirmation that Bitfinex itself was the main vector of attack. 

As it turned out, the person in control of the wallet that initially received all of the stolen bitcoins from Bitfinex was none other than Lichtenstein, investigators allege.

Some of the bitcoins—around 25,000—moved first to accounts at the darknet market AlphaBay, which shut down in an international law enforcement operation in 2017, and then through a series of accounts at online cryptocurrency exchanges, which are referred to in the statement of facts as Virtual Currency Exchanges, or VCEs. After requesting information from the online cryptocurrency exchanges, investigators found that some of those accounts were either in the name of Lichtenstein or Morgan or in the name of one of their companies, according to the statement of facts. 

For example, one of the accounts involved in laundering the Bitcoins was opened in 2015—before the Bitfinex hack—at an online cryptocurrency exchange in Lichtenstein’s name, with an email address containing Lichtenstein’s first name, and verified with a photograph of his California driver’s license, and a “selfie-style photograph,” the investigator wrote in the statement of facts. 

The authorities requested information from all the exchanges where accounts involved in the movement of the stolen bitcoins were registered. Representatives from the exchanges followed up with the account owners, Morgan and Lichtenstein, asking how they obtained the funds in the wallets. The couple’s answers at times contradicted what investigators found by analyzing the funds' movements through the Bitcoin blockchain, according to the document. 

In one case, Morgan said: “My boyfriend (now husband) gifted me cryptocurrency over several years (2014, 2015,), [sic] which have appreciated. I have been keeping them in cold storage.” Lichtenstein told the same exchange, where he also had an account in, that the funds came from investments. But according to the investigators' blockchain analysis, “the primary source of the BTC was the VCE 4 [Virtual Currency Exchange] accounts that were opened in 2017 after the hack.” 

In the document, the IRS investigator explained that the key evidence in the case was found within a cloud storage account owned by Lichtenstein. Thanks to a search warrant, investigators obtained a copy of the files stored in the account in 2021, but several of them “were secured with a strong encryption algorithm and a lengthy password,” according to another court document filed on Thursday. 

At the end of January, however, the agents were able to decrypt them—at this point, it’s unclear how. Decrypting Lichtenstein's files allowed them to access the wallet where all of the hacked funds from Bitfinex were sent, and where the majority remained. 

According to investigators, that wallet contained over 2,000 cryptocurrency addresses, and Lichtenstein's file held the private keys for all of them. “Blockchain analysis confirmed that almost all of those addresses were directly linked to the hack,” the IRS investigator wrote. 

Lichtenstein’s cloud storage also contained a spreadsheet with a list of the wallets used in the money laundering scheme, some of them labeled as “dirty,” according to a court document filed by prosecutors on Thursday. 

Authorities were able to seize around 95,000 of those stolen bitcoins, worth nearly $4 billion. Some of the remaining 25,000 are still allegedly under the control of the couple. Prosecutors believe that the two have access to at least approximately 7,500 BTC (worth around $300 million), which come from the wallet that originally received the money stolen from Bitfinex, according to a court document filed on Thursday.  

The federal government says Lichtenstein and Morgan are criminals, masters of “deceit and deception,” and flight risks. In a court filing Thursday, prosecutors say that they seized dozens of burner phones, more than $40,000 in USD and foreign currency, hardware crypto wallets, and books with hiding places cut into the pages for storing USB drives. The filing states that while their home was being searched, Morgan asked federal agents for permission to retrieve her cat (who features prominently on Morgan's TikTok) from under the bed. While doing so, she tried to lock her phone.

“While Morgan was crouched next to the bed calling to the cat, she positioned herself next to the nightstand, which was still holding one of her phones,” the filing states. “She then reached up and grabbed her cell phone from the nightstand and repeatedly hit the lock button. It appeared that Morgan was attempting to lock the phone in a way that would make it more difficult for law enforcement to search the phone’s contents. Law enforcement had to wrest the phone from her hands.”

Thursday's filing also states that the government has a wealth of evidence suggesting that the couple traveled to Ukraine in 2019 to set up false identities, create fake passports, and “have established financial accounts in Russia and Ukraine, and appear to have been setting up a contingency plan for a life in Ukraine and/or Russia prior to the COVID-19 pandemic,” which they stored on encrypted drives seized by the government. 

The couple also allegedly researched how to get fake passports on the dark web. The court document filed on Thursday includes screenshots of links to forums and websites that advertise fake documents. Investigators found the links in a file contained in Lichtenstein’s cloud storage. 

The couple's lawyers argued that Morgan and Lichtenstein stayed in the country even after they knew they were being targeted by an investigation, that they had frozen embryos and were planning on starting a family and would not be willing to leave those behind in the United States, and that Morgan was recovering from a series of medical issues (which she posted extensively about on social media). Their lawyers say that the government has no witnesses willing to testify against them, nor evidence of them discussing any crimes: “no wiretap … no emails, no text messages, and no other communications between any of the alleged conspirators.” 

The government “offers no evidence (direct or otherwise) that Ms. Morgan had any knowing involvement in any of the alleged efforts to conceal the source of the funds that she received, or that she had any knowledge of the allegedly illicit nature of the funds,” her lawyer wrote.

But Thursday, the government claimed that Morgan “played an integral role in the money laundering and fraud scheme,” had extensive knowledge of and used various cryptocurrency protocols to launder money, and was not “an unwitting bystander.”

“The couple’s activities in Ukraine at times appear pulled from the pages of a spy novel,” the feds wrote.

Scheming masterminds, low-level functionaries, unwitting dupes, some combination of these, or something else entirely, the couple is now fixed as villains in the cultural firmament, having achieved the viral infamy that Morgan, at least, seems to have so assiduously sought.

Morgan and Lichtenstein’s lawyers did not respond to a request for comment. The couple is held in jail in Brooklyn, New York, and is scheduled to appear in a bail review hearing on Monday, according to court documents. 

Lybbert told Motherboard in a phone call that he met Morgan during a guest lecture he gave in an international development class when she was a senior. She showed interest, stood out among the students, and followed up with him after the class. He described her as professional, with good people and communications skills, and “smooth about how she presented herself.” 

“She was always kind of plotting for her next thing, but in the way that all ambitious young people do early in a profession,” he said. “Never in a way that raised suspicions, but she was clearly very motivated, very ambitious, very polished, very particular about how she presented herself.”

After Morgan graduated, she reached out to him again, he said, offering to help in anything that he was working on with the goal of preparing her application to study economics in graduate school. (She would go on to earn a master’s degree in economic development from the American University in Cairo.)

“She just wanted to kind of cut her teeth a bit,” he said, adding that he enlisted her help because “for her age, she was very widely read, and very well-versed in the policy landscape of the Middle East.” 

Lybbert said they collaborated virtually for most of 2012 using Skype, as Morgan was in Egypt at the time. The two parted ways after the paper was published, Lybbert said, and it was “a big shock” to find out about the accusations against her; 10 years ago, he’d imagined her on a path toward a doctorate in economics. 

Morgan would soon show the same ambition and capability in a very different environment. In 2013, the same year her paper was published, Morgan attended a startup incubator run by VC firm 500 Startups, which took place over four months in California. At the time, Morgan worked as a product marketing manager for Tamatem Games, a publisher of mobile games aimed at Arabic speakers that was participating in the 500 Startups program. (Tamatem did not respond to a request for comment; 500 Startups confirmed to Motherboard in an email that Morgan worked for Tamatem and that it went through the accelerator program.) 

During the incubator, Morgan presented herself in a radically different way than she did in the YouTube and TikTok rap videos that would later create a media firestorm around her case. She wore much more mellow outfits, such as a pearl necklace with a white embroidered top, and sometimes donned a 500 Startups-branded T-shirt.  

Everyone in the accelerator became very good friends, a source with direct knowledge of it told Motherboard in a phone call. (Motherboard granted the person anonymity to speak more candidly about the event.) 

“She was always, like, a hustler,” this person said, adding that she made a good impression and that her motivation appeared to be to start something that would make her independent, and make her feel like she had power over her own destiny. In their conversations, she never appeared to be after money, they said; she was resourceful, and knew how to get to people and how to get hired, becoming one of the people everyone knew in the incubator despite not being a company founder at the time. 

“You know she’s going to make it,” they said.

One night, a group including Morgan went to a bar and Lichtenstein was there, the person said; people were drinking, the pair started talking, and eventually, they became very close.

According to online databases, Lichtenstein—a Russian-U.S national, according to the DOJ’s statement of facts—grew up in the Chicago area, and attended the University of Wisconsin. For some period of time he worked for the WordPress Foundation, which did not return a request for comment. In 2011, he attended the Y Combinator incubator, which also did not return requests for comment, and started up MixRank, a company that provides data products for digital marketing. (A chat bot to which Motherboard repeatedly spoke to on the MixRank website, which does not list contact information, did not fulfill its promises to ensure that a team member would email shortly.) Its investors, beyond 500 Startups, included Y Combinator, Seraph Group, and Mark Cuban Companies; the latter’s proprietor, Mark Cuban, told Motherboard in an email that he never met Lichtenstein, and hadn’t heard from him since 2012. 

One of the difficulties in establishing anything substantial about Morgan and Lichtenstein is how vaporous some of their companies seem to have been, despite the overwhelming scope and depth of their online presences. Hundreds of social media posts and stories in Forbes and Inc., where Morgan was a frequent contributor, depicted the couple’s ventures as successful and their work as founders as aspirational and worthy of emulation. While some of their companies were clearly real in the sense that they hired employees, did business, and received funding, though, it’s unclear exactly what others did or on what scale they operated.

Three of these ventures—SalesFolk, Demandpath, and Endpass—were cited in charging documents: Prosecutors say that accounts controlled by these entities were used in the laundering scheme. A Thursday filing states that the couple used payments from customers to SalesFolk and from shell companies for “advertising services” to launder crypto: "​”However, Shell Company 1 had no website, and investigators were unable to identify any legitimate business activity by Shell Company 1, much less any advertising.” 

These businesses, though, were just part of a broader network of ventures started by the couple, some of which remain somewhat mysterious.

In 2014, for example, Morgan incorporated, and was listed as agent for, a business called Tehama Ventures Limited in California. It shares a name with the county where her parents live, and a filing lists one of its corporate addresses as one associated in online databases with Morgan’s parents. These filings also list it as a branch of a Chinese company, the address of which resolves to a flat in Hong Kong. A Westerner connected to that address in online records didn’t answer a call or LinkedIn message from Motherboard. The nature of the business is unknown. It should be noted that “Shell Company 1” in the government's Thursday filing “claimed to operate out of Hong Kong,” though Motherboard has no specific evidence that Tehama Ventures Limited is the company listed in the government's filing.

In 2014, Morgan incorporated SalesFolk, a company that says it helps other firms improve the efficiency of their sales pitches. From 2014 up to last year, in clips uploaded to the company’s YouTube channel, Morgan gave regular advice on how to properly send cold emails and tips on how to be a “rockstar remote worker.”

People associated with SalesFolk did not respond to messages from Motherboard.

Demandpath, the second company associated with the money laundering scheme, was incorporated by an agent in Delaware in 2017, with a California branch being incorporated a month later. Its sparse website describes it as “a boutique micro-fund investing in the next generation of promising technologies” including “decentralized applications.” Morgan listed herself as a partner in the company on LinkedIn, and Lichtenstein listed himself as an investor; the DOJ’s statement of facts says that Lichtenstein represented it as a company he wholly owned. Demandpath has no public investments, and investigators could not uncover any public information aside from its website. The most substantial evidence of its dealings online is that it hosted a competition at a design site for “a weird, creative poster for a female rapper.” (One of the winners of the competition told Motherboard, “I don't know anything about Razzlekhan because I'm from Indonesia.”)

Endpass, which sought to make a secure crypto wallet, may in some ways be the most typical of these companies. Morgan listed herself as CEO on LinkedIn, but the company was, according to the DOJ, owned by Lichtenstein. Energetic online promotion of the company didn’t attract much of an audience. Its Twitter account had two dozen followers as of this writing, with none of those to whom Motherboard reached out having anything to say about whether they knew Morgan or Lichtenstein. Its articles on Medium—one explains what blockchain technology is—seem to have attracted little notice. A video posted by Endpass reviewing its own product features a robot speaking in a monotone and extolling its features; it had been viewed 92 times as of this writing, with several of those coming from a Motherboard reporter.

Several people connected to the company, including coders on GitHub and an HR manager whose online profile places her in Bashkortostan, Russia, did not respond to Motherboard’s messages. Its most substantial online presence may have been on Telegram, where a small group devoted to it was set up in 2018. While most of the people who posted in it did not respond to messages, Motherboard spoke to several people who posted in the group who said they were Russian job-seekers who had been referred there by listings for remote workers. 

One person who worked for the company for several months told Motherboard in an online chat that they’d never heard of Morgan. This person, who worked on a team of seven or eight people, dealt with Lichtenstein. 

“Ilya was a good boss,” they said, “and always seemed to be a nice, hard-working guy.” It was a huge surprise to see him in the news, they said. “The only odd thing was the fact, that he often told that the budget for the project is not very large. And today I thought, how can our budget be small if it seems that he had all that crazy money? Also, he always tried to pay contractors as little money as possible.”

If anything was unusual, they said, it was that Lichtenstein was a good boss by startup standards.

“I’ve worked for a lot of startups in my life,” they said, “and this one was just the same as others except Ilya didn’t look like a typical startup founder. He seemed smart, calm and pleasant. These startup guys often want to make an x1000000 in two days. Ilya wasn’t like that.”

In a December 2019 email obtained by Motherboard, Lichtenstein announced that the entire Endpass marketing team was being cut. 

“Due to the fall of the crypto market, a lot has changed. Companies need to change their strategy,” he wrote. (The email was in Russian.) “Unfortunately it was decided to cut the entire marketing team. Today is your last day.

“Everyone will be paid a salary for one more month of work. Of course, I offer everyone good recommendations and help in finding a new job. It was a pleasure to work with you and wish you success.”

These seem to have been prosperous years for Morgan and Lichtenstein; online records place them in apartments in San Francisco’s Mission District and New York’s Chelsea and Financial District. Along the way, Morgan evolved her now signature flamboyant style. In 2017, she co-hosted a night at the Greenwich Village Comedy Club in which she and a group of panelists roasted annoying business emails. In 2019, she gave a talk at a New York City event called “How to Social Engineer Your Way Into Anything.” Between February 2019 and December 2020, investigators allege, 117 BTC worth $500,000 at Bitcoin's current price flowed through a cluster of addresses to accounts controlled by Lichtenstein and Morgan. Part of that went to purchasing gift cards for Walmart, Uber, and Hotels.com that the couple allegedly used to cash out. 

For years, she has followed this advice religiously. Morgan has active and prolific Twitter, Facebook, Instagram, YouTube, Vimeo, Soundcloud, Etsy, and Spotify accounts, most of which do not repeat content from each other. These accounts, which heavily feature Lichtenstein, show a young couple in their 30s who are seemingly having a nice time and live a comfortable, upper-class life consistent with what one would expect from two people succeeding in tech. They clearly have money, but none of their posts suggest that they were secretly sitting on more than a billion dollars. 

After the pair was arrested, videos on Morgan’s YouTube account went private, but most of her other accounts are still open. According to a filing from the couple’s lawyer, Morgan was aware of the government's investigation into them for months, but continued to religiously post to social media. Even so, it's hard to know how much to glean from her posts. 

“I taste all her cat food, and I was like, this is pretty good,” Lichtenstein said in a video Morgan filmed of him eating their cat’s food. "It needs salt, it needs pepper, but other than that, it's pretty good. That's why I bought a bunch … You keep filming me expecting something to happen? You want me to shove something up my ass and do a little dance? Is that what you're waiting for?" 

She quite obviously didn't and doesn't take herself too seriously: “That's kind of my life's motto … make me cum or make me ca$h,” she said in a Facebook video about a glow-in-the-dark shirt she made, before launching into a freestyle. 

“Yo Razzlekhan here with a little unfiltered behind the scenes, first of all, I'm wearing no makeup, so it's truly unfiltered. Your best self is always your real self, don't forget that!,” a line she calls a “Razzleism.”

Her TikToks include: 

• Freestyle raps about losing your AirPods and being a GILF, peeing, “vag itch,”  the pandemic (“fuck the pandemic, I just want to travel, stop this shit before I start to unravel, fuck the pandemic, fuck the pandemic, end the pandemic, 2022. WHAT! Razzledazzle. Seriously though fuck this shit”), etc.
• Twerking to Weezer's Island in the Sun and also, separately, on a Manhattan rooftop
• Her and Lichtenstein decorating a Christmas tree
• Lichtenstein complaining lightheartedly about always being turned into content (“If you're interested in what I say, record it the first time. I'm not a little wind-up monkey who's going to say the same thing a second time.”)
• Posts about her health, her nails, her streetwear, her art, lemon cookies, etc.
• Working in her studio, called the “Razzleuniverse”

This gimmicky persona is much different from the straightforward, businessy blogs she posted, which covered such thrilling topics as “3 Great Ways to Scalably Train New Hires,” “Hiring Creatives? Look for These Traits,” and “This American Billionaire Is Joining the State Department. Why That’s Good News for Entrepreneurs.”

She was a relentless networker, saying Zoom CEO Eric Yuan and Keith Crock, the former CEO of DocuSign, “taught her a lot.” She tweeted a picture of herself with John McAfee, the late antivirus company owner and alleged fraudster. She was a fan of the “cold email,” and advised young people to just reach out to people they wanted to talk to. In November, Morgan did that with Motherboard editor Jason Koebler, DMing him on both Signal and Twitter: “Hey Jason, I just had to say I really enjoy your articles and tweets. Especially the ConstitutionDAO. Love your no bullshit attitude, calling out the bullshitters. - your fellow writer.” 

Morgan did not respond to DMs, phone calls, and Signal messages from Motherboard after her arrest. Signal indicates she did not see a message sent to her; it's unclear whether she has access to her phone.  

Morgan followed her mantra of “posting content” outside of social media as well, working as a freelance contributor to Inc. and Forbes. Morgan wrote 47 articles for Forbes as a “ForbesWoman” contributor between December 2017 and September 2021. Her posts ranged from interviews with artists such as Ashinikko and Awkwafina (a representative for whom ignored Motherboard’s requests for comment) to self-help guides on how to be a good negotiator and how to beat boredom during the pandemic. Some of her articles included personal anecdotes that help paint a picture of who she was, or at least who she wanted to be perceived as: A successful and precocious tech entrepreneur driven by “determination and curiosity,” and a “neurotic obsessive workaholic.” 

“Using my negotiation skills, I’ve closed six-figure deals over nothing but email and a five-minute phone call, knocked twenty grand off my rent, and saved tens of thousands in health insurance. I built a multi-million dollar business in my early twenties without any investor funding, and forged many lucrative business partnerships with major brands, all without introductions or attending an Ivy League school,” Morgan wrote in one post. 

In another article published in September of 2020, she wrote that she started her last company when she “was totally broke and jobless, and quickly made it profitable.” 

“I built that business into a million dollar business employing dozens of people, so it’s possible—just really difficult,” she added. 

In the articles, Morgan often made references to her diverse international background, mentioning she lived in Hong Kong and Egypt. Her background was in part built on her trips to countries such as Japan and Turkey, which forced her to learn several languages, such as Japanese—“business level proficiency”—and “enough Korean, Turkish, Arabic, and Cantonese to negotiate, navigate, order food, and make friends in those respective languages.” She also claimed to be studying Russian in 2020, according to one of her articles. 

When Motherboard asked about her role at Forbes, Bill Hankes, a company spokesperson, said he “wouldn’t call her prolific,” given that she published once a month or so. 

“All contributors must pass an editorial review process, and if selected as a contributor, sign a contract requiring them to abide by a set of editorial guidelines. We also regularly and thoroughly review our network of contributors to ensure they are meeting our high editorial standards, and we pay close attention to ensure compliance,” he said, explaining that she had an editor. (Some articles written by Forbes contributors are not edited before being published.) 

In an article about Morgan, Forbes’ reporters said that the company removed Morgan months before she was accused of being a money launderer, “in September 2021 during a routine semiannual review.”

Morgan also wrote more than 100 articles for Inc magazine on topics similar to the ones she covered in her Forbes posts.

Inc did not respond to a request for comment. The magazine has added a note at the beginning of her articles. “Upon her indictment on federal money laundering charges and her arrest February 8, 2022, Inc. dismissed Heather Morgan as a contributing columnist. As is our practice, we do not unpublish editorial content, and rather have added this note for full transparency.”

Much of Morgan's online history is ironic in retrospect. In 2020, she wrote an article about tips on how to protect businesses from hackers, in which she interviewed David Zacks, at the time the chief compliance officer of cryptocurrency exchange BitFlyer. Zacks told her that it’s important for companies such as his to be proactive and keep tabs on their customers.

“That’s why we try to really know our customers and carefully monitor for unusual activity,” Zacks told her.

(Ironically, one of the ways the feds were able to identify Morgan and Lichtenstein’s cryptocurrency wallets and accounts was by demanding companies to turn over information on the owners of those accounts, under so-called “Know Your Customer” regulations, according to the DOJ’s  statement of facts.)

In the same article, she also quoted Matt Parrella, the former chief compliance officer of BitGo, the blockchain security company that Bitfinex used to secure the bitcoins that were stolen in 2016. Parrella, no longer at BitGo, did not respond to a request for comment sent over LinkedIn.  

“We’re pleased that DOJ has recovered a significant portion of the bitcoin stolen during the 2016 hack. We have been cooperating extensively with DOJ since its investigation of this incident began. We appreciate the dedication and hard work by the DOJ team that led to this great success, and we will continue to support their efforts,” Chi Zhao, a spokesperson for Bitfinex, said in an email.

Zhao declined to comment further when asked whether the company believes the couple are the ones who originally stole the bitcoins. 

Morgan’s dabbling in cringe-worthy rap music, of course, was the content posting that has drawn most attention to her case. She said she got into music and art in 2018 “following severe burnout and some other health issues,” choosing the moniker Razzlekhan “as a tribute to my Turkish heritage, and a deep appreciation for North African Bedouin culture.” The persona is described as “like Genghis Khan, but with more pizzazz” on her official website.

Of all the elements in this story, the existence of Razzlekhan may be the most bewildering. While making bad music is a viable path to fame, it would be impossible for her, or anyone, to be unaware of how objectively bad her tuneless, off-beat rapping was. It was clearly performance art of some kind, from someone who seems to have been, earnestly, an aspiring artist. (Coleman, her artist friend, recalled her texting him two weeks ago, just ahead of a surgery she had scheduled, to ask about the materials he used for sculpting.) 

Keyzus, a producer who worked with Razzlekhan and has previously worked with, among others, Rick Ross and Fetty Wap, politely declined to comment when reached by Motherboard. Coleman was diplomatic when asked about her music.

“Oh man,” he said. “Pretty interesting, let’s say that. Very fucking interesting.”

Whatever the point of the joke, or performance, Morgan was committed to it past simply posting horrible songs on Youtube and Soundcloud. Last May, she posted to Facebook from Cipriani, a fancy New York restaurant where she was celebrating her birthday, urging followers to text her to get unreleased art. After texting the number, Motherboard was told by a robot to register for a Razzlekhan community; there have since been no further communications.

As for what will happen with the seized bitcoins, it looks like everyone wants a piece. The government has said that people who had bitcoins stolen from them in the 2016 hack will be able to get them back via a court process. Bitfinex, meanwhile, said in a statement after Morgan and Lichtenstein's arrest that it hopes to receive the seized funds. The reason: In 2019, Bitfinex launched a token called Unus Sed Leo to boost its coffers and pledged to use 80 percent of any funds recovered from the 2016 hack to buy tokens on the open market, burn them, and theoretically boost its price. Bitfinex recommitted to this in its statement this week, adding that it “will work with the DOJ and follow appropriate legal processes to establish our rights to a return of the stolen bitcoin,” which led to a rally in the price of the  tokens. 

What the future holds for the couple is obviously unclear. Their bail hearing was moved to Monday. In her TikToks, though, Morgan talks often about growing old, and imagining a present, and a future, where she doesn't give a fuck: “I don't know about you, but I look forward to getting old, because you know why? I'm going to be a GILF because I already am one. I've always been an 83-year-old at heart, also, a 12-year-old's filthy sense of humor,” Morgan joked on TikTok to promote her track “GILFalicious.” 

“If my lovely husband dies, I will have plenty of fuckbois, and it's going to be pretty epic.”

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.