Former Amazon security engineer Shakeeb Ahmed pleaded guilty in December 2023 to one count of computer fraud after attacking two decentralized cryptocurrency exchanges in July 2022. In April 2024, he was sentenced to three years in prison. The U.S. Department of Justice described the case as the first conviction involving a smart-contract hack.
Who was Shakeeb Ahmed?
Ahmed was a former Amazon security engineer. He admitted to hacking two decentralized cryptocurrency exchanges in July 2022. The U.S. Department of Justice said the attacks stole cryptocurrency worth more than $12 million.
Which exchanges did he attack?
An unnamed Solana exchange
The DOJ case material describes the first victim as an unnamed decentralized exchange incorporated overseas and operating on Solana. It used smart contracts and liquidity pools to operate as an automated market maker. BleepingComputer reported that the attack details matched Crema Finance, but prosecutors did not explicitly name the exchange; Crema Finance should therefore be treated as a reported identification, not an official DOJ confirmation.
Nirvana Finance
The second target was Nirvana Finance, a decentralized finance protocol. BleepingComputer reported that Ahmed exploited a smart-contract flaw and obtained approximately $3.6 million. The platform later shut down.
Recommended Free Tools
#1 Best Overall
How did the attacks work?
Manipulating fees at the first exchange
According to BleepingComputer, Ahmed manipulated a smart contract to introduce false pricing data, generating about $9 million in inflated fees. He reportedly offered to return all but approximately $1.5 million if the exchange did not involve law enforcement.
Using a flash loan at Nirvana
BleepingComputer reported that Ahmed used a flash loan to acquire ANA tokens at a low price and then sold them at a higher price, making approximately $3.6 million. Nirvana reportedly offered a $300,000 bounty, while Ahmed sought $1.4 million; the parties did not reach an agreement.
Moving and concealing the proceeds
The court-document material describes Ahmed swapping tokens, bridging proceeds from Solana to Ethereum, converting proceeds into Monero and using overseas exchanges. BleepingComputer also reported the use of cryptocurrency mixers and cross-chain transfers.
What did Ahmed plead guilty to, and what was the sentence?
In December 2023, Ahmed pleaded guilty to one computer-fraud count. BleepingComputer reported that his plea included a commitment to pay $5,071,074.23 in restitution to victims and to forfeit more than $12.3 million, including about $5.6 million in cryptocurrency.
Rank #3
In April 2024, Ahmed was sentenced to three years in prison. BleepingComputer reported that the sentence also included three years of supervised release, forfeiture of $12.3 million and restitution to the two victims. The $5,071,074.23 figure is the restitution commitment reported at the plea stage; it is distinct from the later sentencing summary.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why the case matters
The DOJ characterized Ahmed’s conviction as the first involving the hack of a smart contract. The case also shows that attacks on decentralized exchanges can involve different mechanisms: one attack reportedly manipulated pricing data to inflate fees, while the other exploited a protocol flaw in a token transaction. A smart contract’s automated operation does not make it immune to fraud or criminal prosecution.
For projects building or operating smart-contract systems, an independent security review can be relevant, but an audit is not a guarantee against an attack. Evaluating a provider means looking at the scope of its review, its chain and programming-language experience, how findings are independently reviewed, and whether it supports remediation. Nothing in this case establishes that any particular audit provider would have prevented these attacks.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
