US: Former Security Engineer Jailed for $12M Crypto Hacks in Landmark Prosecution

A former security engineer, Shakeeb Ahmed, was sentenced to three years in prison for stealing over $12 million in crypto by exploiting vulnerabilities in smart contracts on decentralized cryptocurrency exchanges. This conviction marks the first-ever smart contract hacking conviction in the US.

Former Security Engineer Exploits Crypto Vulnerabilities, Sentenced for $12 Million Hacks

Byline: News Desk

New York, USA - Former security engineer Shakeeb Ahmed, found culpable for orchestrating a series of hacks targeting two decentralized cryptocurrency exchanges (DEXs) and pilfering over $12 million worth of crypto, has been sentenced to three years in prison. This groundbreaking conviction marks the first-ever instance of a successful prosecution for smart contract hacking in the United States.

Inculpatory Evidence

As per court documents, Ahmed launched two distinct attacks on DEXs. On July 2-3, 2022, he manipulated fake pricing data to generate inflated fees of approximately $9 million, which he promptly withdrew in cryptocurrency. Subsequent to the theft, Ahmed reached out to the targeted exchange, offering to reimburse the stolen funds, less $1.5 million, on the condition that the exchange refrain from involving law enforcement.

On July 28, 2022, Ahmed set his sights on another decentralized exchange, Nirvana Finance. Exploiting a vulnerability in Nirvana's smart contracts, he purchased crypto assets at artificially low prices and swiftly resold them back to Nirvana at inflated prices. Despite Nirvana offering a substantial "bug bounty" of up to $600,000 for the return of the stolen funds, Ahmed demanded an exorbitant $1.4 million. Ahmed's actions precipitated the collapse of the exchange, which lost its entire inventory of funds, estimated at $3.6 million.

Unraveling the Cybercriminal

The investigation unveiled that Ahmed employed sophisticated money laundering techniques to obfuscate the origin and ownership of the stolen funds. These tactics included token swap transactions, bridging assets between the Solana (SOL) and Ethereum (ETH) blockchains, converting funds to Monero, and leveraging overseas exchanges and cryptocurrency mixers such as Samourai Whirlpool.

Ahmed, a U.S. citizen, held a senior security engineer position at a multinational technology firm at the time of the attacks. His professional credentials attested to his expertise in reverse engineering smart contracts and conducting blockchain audits, skills he brazenly leveraged to perpetrate the hacks.

Consequences of Cybercrimes

Along with the three-year prison sentence, Ahmed has been ordered to serve three years of supervised release. Moreover, he must forfeit approximately $12.3 million, encompassing a substantial amount of cryptocurrency, and compensate the affected exchanges in excess of $5 million.

Commenting on the groundbreaking verdict, U.S. Attorney Damian Williams emphasized, "Today, Shakeeb Ahmed has been sentenced to prison in the first-ever conviction for the hack of a smart contract and ordered to forfeit all of the stolen crypto. No matter how novel or intricate the hack, this Office and our law enforcement allies are unwavering in our commitment to pursuing the stolen funds and ensuring that hackers face justice. And as today's sentence exemplifies, imprisonment and forfeiture of all stolen crypto are the inevitable repercussions of such nefarious acts."

Implications

The prosecution of Ahmed serves as a stark reminder of the evolving nature of cybercrimes and the growing sophistication employed by cybercriminals. As decentralized financial ecosystems continue to expand, so too does the need for robust security measures and vigilance against malicious actors seeking to exploit vulnerabilities. This verdict underscores the resolve of law enforcement agencies to combat these emerging threats and hold accountable those who perpetrate them.