According to the U.S. Attorney's Office for the Southern District of New York, former security engineer Shakeeb Ahmed exploited two decentralized cryptocurrency exchanges in July 2022 and stole more than $12 million in cryptocurrency. Ahmed stole approximately $9 million from the first exchange by manipulating data used by its smart contracts and later stole approximately $3.6 million from Nirvana Finance. The DOJ reported that the Nirvana theft represented nearly all of the exchange's funds, resulting in its shutdown.
According to the DOJ, Ahmed attempted to conceal the stolen cryptocurrency through token swaps, transfers between blockchains, Monero, overseas cryptocurrency exchanges, and cryptocurrency mixers. Ahmed pleaded guilty to computer fraud and was sentenced in April 2024 to three years in prison and three years of supervised release. He was also ordered to forfeit approximately $12.3 million and pay more than $5 million in restitution. The U.S. Attorney's Office described the case as the first conviction for hacking a smart contract.
According to the federal indictment, Ahmed tested the exchange with small transactions before carrying out the attack and created accounts designed to masquerade as legitimate accounts used by its smart contract. Prosecutors alleged that he inserted fake pricing data that made it appear he had provided substantially more liquidity than he actually had. Ahmed then used at least 21 flash loans worth tens of millions of dollars across five liquidity pools, generating approximately $9 million in fraudulent fees.
The July 13, 2023 HSI release provides additional details about Ahmed's actions after the attack and the evidence investigators uncovered. HSI stated:
After the attack, Ahmed searched online for information about the attack, his own criminal liability, criminal defense attorneys with expertise in similar cases, law enforcement ability to successfully investigate the attack, and fleeing the United States to avoid criminal charges.
HSI reported that these searches included "wire fraud," "evidence laundering," "can I cross border with crypto," "how to stop federal government from seizing assets," and "buying citizenship." According to Inner City Press, the investigation also involved Google subpoena returns, more than 20 seized devices, Ahmed's laptop from his former employer, and approximately 90 gigabytes of discovery provided to his defense. Inner City Press later reported that federal prosecutors requested a 48-month prison sentence.
The April 12, 2024 U.S. Attorney's Office release revealed additional details about Ahmed's second attack against Nirvana Finance:
Ahmed used an exploit he discovered in Nirvana smart contracts to allow him to purchase cryptocurrency from Nirvana at a lower price than the contract was designed to allow. He then immediately resold that cryptocurrency to Nirvana at a higher price.
According to the U.S. Attorney's Office, Ahmed stole approximately $3.6 million from Nirvana, representing nearly all of its funds, after rejecting a bug bounty of up to $600,000 and demanding $1.4 million instead. Nirvana shut down shortly afterward. The DOJ also reported that Ahmed concealed proceeds through token swaps, transfers between the Solana and Ethereum blockchains, Monero, overseas exchanges, and cryptocurrency mixers. Ahmed was ultimately sentenced to three years in prison, ordered to forfeit approximately $12.3 million, and ordered to pay more than $5 million in restitution.
