Nirvana Finance Hacker Surrenders More Than $12.3 Million, After Pleading Guilty

Shakeeb Ahmed, a senior security engineer, has admitted to hacking two decentralized cryptocurrency exchanges, marking the first-ever conviction for a smart contract breach.

The announcement was made by Damian Williams, the United States Attorney for the Southern District of New York, following Ahmed’s guilty plea to computer fraud charges.

Nirvana Finance Hacker Holds Extensive Expertise in Smart Contracts

According to the statement, Ahmed’s exploits involved the July 2022 hack of Nirvana Finance and another attack on a decentralized crypto exchange.

As part of his plea, Ahmed agreed to forfeit $12.3 million. This includes approximately $5.6 million in fraudulently obtained crypto.

U.S. Attorney Damian Williams highlighted the significance of Ahmed’s conviction. He emphasized that regardless of the complexity of cyber methods, fraudulent activities would be promptly identified and prosecuted.

The statement alleges that Ahmed has expertise in reverse engineering smart contracts and blockchain audits. He reportedly executed the hacks while employed as a senior security engineer for an international technology company.

Meanwhile, the first attack targeted a crypto exchange, where Ahmed exploited a smart contract vulnerability, causing it to produce around $9 million in inflated fees.

However, after successfully withdrawing the funds, Ahmed engaged in negotiations with the exchange. He allegedly offered to return most of the stolen funds in exchange for not involving law enforcement.

Read more: What Is a Rug Pull? A Guide to the Web3 Scam

Ahmed Employed Sophisticated Methods to Mask Illicit Profits

The second attack unfolded on Nirvana Finance, a decentralized finance protocol.

Ahmed leveraged a flash loan of $10 million, manipulating the protocol’s smart contracts to reap a $3.6 million profit. Despite Nirvana’s offer of a bug bounty, Ahmed demanded $1.4 million, leading to the platform’s closure.

To conceal his illicit gains, Ahmed employed advanced laundering techniques. This included token-swap transactions, blockchain bridging, Monero exchanges, and the use of crypto mixers.

Following the attacks, Ahmed actively sought information about his criminal liability, criminal defense strategies, and ways to flee the U.S.

He conducted internet searches related to “defi hacks,” law enforcement investigations, and methods to prevent asset seizure.

Shakeeb Ahmed, 34, faces a maximum sentence of five years in prison and has agreed to pay restitution totaling $5,071,074.23 to his victims.

His sentencing is scheduled for March 13, 2024, before United States District Judge Victor Marrero.

Read more: 15 Most Common Crypto Scams To Look Out For