Key Takeaways
- Ahmed was charged in July 2023 with wire fraud and money laundering tied to the hacks
- Attorney Damian Williams stated that Ahmed’s conviction was the first for hacking a smart contract.
Computer security engineer Shakeeb Ahmed has been sentenced to three years in the Southern District Court of New York for his involvement in the 2022 Nirvana exploit, a flash loan attack. This landmark ruling represents the first conviction for hacking a smart contract, as announced by the Department of Justice.
In a statement, US Attorney Damian Williams emphasized the commitment to pursuing hackers, stating, “No matter how novel or sophisticated the hack, this Office and our law enforcement partners are committed to following the money and bringing hackers to justice.” Williams highlighted the inevitable consequences of such actions, including imprisonment and forfeiture of all stolen cryptocurrency.
Ahmed, who pleaded guilty to the charges in December of the previous year, forfeited $12.3 million, with approximately $6 million in cryptocurrency. Additionally, he was ordered to pay restitution to the Crypto Exchange and Nirvana in excess of $5 million.
The charges against Ahmed were initially brought in July 2023, initially linking him to the hack of one exchange. However, further investigations revealed his involvement in a multi-million dollar hack on another exchange, deepening his implication in the case.
Ahmed’s attempts to evade authorities by utilizing Google were disclosed in the original indictment. Allegedly, he searched for terms such as “defi hack” and “how to stop federal government from seizing assets” following the exploits.
Nirvana made efforts to negotiate with Ahmed, offering a bug bounty of $600,000 to return the funds. However, negotiations collapsed when Ahmed demanded $1.4 million. Ahmed was found guilty of conducting flash loan attacks on both the decentralized Crypto Exchange and Nirvana exchanges in 2022.
Following his arrest in July 2023 on charges of wire fraud and money laundering, Ahmed pleaded guilty to a single charge of computer fraud in December of the same year. His guilty plea marked the first public connection to the Nirvana hack.
Ahmed’s laundering of the hacked funds involved various methods, including token-swap transactions and utilizing cryptocurrency mixers. At the time of the attacks, Ahmed held a senior security engineer position for an international technology company and served as the technical lead of Amazon’s bug bounty program.
Reportedly, Ahmed works for a mental health care startup after being released on bail. During his trial, he expressed remorse, stating, “I witnessed hacks, I found a way to exploit an exchange’s smart contracts. I went into therapy.”
