A senior security engineer has plead guilty over the hacking of two separate decentralised cryptocurrency exchanges and stealing more than US$12 million.
Shakeeb Ahmed, who formerly worked as a security engineer with Amazon, admitted to the previously unsolved multi-million-dollar hack of Nirvana Finance as part of his plea.
In early July, 2022, Ahmed hacked the first of the exchanges, referred to as the "Crypto Exchange", by exploiting a vulnerability in one of its smart contracts. Ahmed inserted fake pricing data to inflate the contract and generate approximately $9 million dollars' worth of fraudulent fees, which he was able to withdraw from the Exchange as cryptocurrency.
In late July, 2022, Ahmed took out a flash loan with Nirvana Finance for around $10 million to purchase its cryptocurrency token, ANA. He used an exploit in Nirvana's smart contracts to purchase the ANA at its initial, low price, and not the higher price he should have been charged. Ahmed then resold his ANA to Nirvana at the higher price, giving him a profit of around $3.6 million, which amounted to all the funds Nirvana possessed and forced it to shut down.
Ahmed laundered the millions he stole in order to conceal the source and ownership, using sophisticated techniques including token-swap transactions, "bridging" fraud proceeds from the Solana blockchain over to the Ethereum blockchain, exchanging fraud proceeds into Monero, an anonymized and particularly difficult cryptocurrency to trace, using overseas cryptocurrency exchanges, and using cryptocurrency mixers such as Samourai Whirlpool.
Ahmed contacted the Crypto Exchange after the hack and said he would return the funds he stole, except for $1.5 million, but only if they agreed not to contact law enforcement. After the hacks he also searched online for, among other things, information about keeping his stolen cryptocurrency, fleeing the US and avoiding extradition. High on his list of searches were the terms "can I cross border with crypto," "how to stop federal government from seizing assets," and "buying citizenship." He also spent time visiting the website, "16 Countries Where Your Investments Can Buy Citizenship".
Ahmed pled guilty to one count of computer fraud - maximum jail term of five years - and agreed to pay restitution to his victims totalling more than $5 million.
"The arrest is now the first ever conviction for such a hack," said Damian Williams, the United States Attorney for the Southern District of New York. "Today's conviction shows that no matter how sophisticated the methods used, fraud is fraud, and we will swiftly catch and convict you."
Ahmed is scheduled to be sentenced on March 13, 2024.
