Recommended Free Tools
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Shakeeb Ahmed, a former senior security engineer, was sentenced on April 12, 2024, to three years in federal prison for computer fraud involving attacks on two decentralized finance (DeFi) exchanges. Prosecutors said the July 2022 attacks extracted more than $12 million in cryptocurrency. Ahmed also received three years of supervised release and was ordered to forfeit about $12.3 million and pay more than $5 million in restitution.
Case at a glance
- Defendant: Shakeeb Ahmed, 34 at sentencing, from New York.
- Attacks: Two separate incidents in July 2022, against an unnamed decentralized exchange and Nirvana Finance.
- Plea: Guilty to one count of computer fraud on December 14, 2023.
- Sentence: Three years in prison and three years of supervised release.
- Financial orders: Approximately $12.3 million in forfeiture and more than $5 million in restitution.
The Justice Department described Ahmed as a senior security engineer at an unnamed international technology company, with experience in smart-contract reverse engineering and blockchain audits. Some news reports identified his former employer as Amazon, based on his public professional profile; the DOJ did not name the company. (DOJ sentencing announcement; SecurityWeek report)
Two attacks, two different weaknesses
These were not one prolonged attack on a single company. Prosecutors described separate exploits against two DeFi protocols, using different smart-contract weaknesses.
| Target | Date | Government’s account | Approximate amount |
|---|---|---|---|
| Unnamed decentralized exchange | July 2–3, 2022 | False pricing data caused a contract to generate inflated fees, which Ahmed withdrew. | $9 million |
| Nirvana Finance | July 28, 2022 | A flash loan and a pricing flaw involving the ANA token enabled a purchase at a lower-than-intended price and a sale back at a higher price. | $3.6 million |
The Justice Department did not identify the first exchange by name. Security-news reports linked the incident to Solana-based Crema Finance by matching publicly reported details, but that identification is secondary reporting, not an official DOJ designation. (BleepingComputer report)
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The first exchange: fabricated fees
According to the government’s account, Ahmed exploited a smart contract on or about July 2 and 3, 2022. He inserted false pricing data, leading the contract to generate roughly $9 million in fees that were not legitimately earned. He withdrew the resulting cryptocurrency. He later offered to return all but $1.5 million if the exchange agreed not to report the incident to law enforcement, prosecutors said.
That is more specific than saying he simply “stole trading fees”: the government said the fees were fraudulently created through manipulated pricing information. (DOJ guilty-plea announcement)
Nirvana Finance: a flash-loan pricing exploit
Nirvana Finance used the ANA token, whose price was designed to rise when a user bought a large quantity and fall when a user sold a large quantity. Prosecutors said Ahmed used a flash loan of about $10 million to acquire ANA. A flash loan is borrowed and repaid within a single blockchain transaction or transaction sequence; it can support legitimate DeFi activity, but it can also provide temporary capital for an exploit.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The government said a smart-contract flaw let Ahmed buy ANA at its initial, lower price instead of the higher price the protocol was meant to charge for such a large purchase. After the protocol’s price updated, he sold the tokens back to Nirvana at the higher price, extracting about $3.6 million—roughly all of the protocol’s funds, according to prosecutors. Nirvana later shut down.
Nirvana offered a bug bounty of as much as $600,000 for the return of the funds, prosecutors said. Ahmed demanded $1.4 million and kept the assets after negotiations failed. That sequence, along with the withdrawal of funds and the alleged effort to prevent a law-enforcement referral, distinguishes the admitted conduct from vulnerability research or responsible disclosure. (DOJ guilty-plea announcement)
How prosecutors said he moved the cryptocurrency
The DOJ said Ahmed tried to obscure the proceeds by swapping tokens, moving assets between the Solana and Ethereum blockchains through bridges, converting some funds to Monero, using overseas cryptocurrency exchanges, and using mixers including Samourai Whirlpool.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Bridge: A service or protocol used to move assets, or representations of assets, between blockchain networks.
- Mixer: A service designed to make transaction tracing harder by pooling and redistributing cryptocurrency.
- Monero: A privacy-focused cryptocurrency with features intended to obscure transaction details.
These tools have uses beyond crime; using one does not by itself establish wrongdoing. Here, prosecutors described the transactions as part of efforts to conceal proceeds from the two attacks. The DOJ also said Ahmed searched for information about DeFi-hack prosecutions, wire-fraud charges, “evidence laundering,” crossing borders with cryptocurrency, avoiding asset seizure or extradition, and buying citizenship. Those details are the government’s account of his searches and do not independently establish motive. (DOJ guilty-plea announcement)
Arrest, plea, and sentence
Ahmed was arrested in July 2023. At that stage, prosecutors charged him with wire fraud and money laundering, offenses the arrest announcement said each carried a potential maximum sentence of 20 years. Those were the initial charges, not the offenses of conviction.
On December 14, 2023, Ahmed pleaded guilty to one count of computer fraud, which carried a maximum sentence of five years. He agreed to forfeit more than $12.3 million and pay $5,071,074.23 in restitution. On April 12, 2024, U.S. District Judge Victor Marrero sentenced him to three years in prison and three years of supervised release. The sentence applied to the admitted computer-fraud conduct arising from both attacks; it was not two separate three-year terms. (DOJ arrest announcement; DOJ plea announcement; DOJ sentencing announcement)
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The figures describe different things. The roughly $9 million and $3.6 million are the amounts prosecutors associated with the two attacks. Forfeiture is the legal recovery of property connected to criminal conduct; restitution is money ordered to compensate victims. Neither figure should be treated as identical to the gross amount taken or to the amount Ahmed offered to return in negotiations.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why the case matters—and what it does not establish
The DOJ called this the first conviction for hacking a smart contract. That is the department’s characterization of the case, rather than a universal finding that no earlier prosecution anywhere involved smart-contract exploitation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The practical significance is clearer: using blockchain code and decentralized protocols did not put the admitted conduct beyond ordinary fraud enforcement. The legal issue was not simply that a contract had a vulnerability. The government described deliberate manipulation, withdrawals of assets not legitimately earned, demands tied to keeping law enforcement out of the matter, and steps to conceal proceeds. Ahmed pleaded guilty to computer fraud.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The case also shows that moving funds across blockchains or through privacy-oriented services did not, in this instance, prevent prosecutors from pursuing forfeiture and restitution. It does not mean every DeFi exploit will be charged the same way: facts, evidence, intent, jurisdiction, and the legal theory all matter. Nor does a bug bounty offer automatically resolve a dispute. Researchers who find a flaw should follow the protocol’s disclosure rules, avoid taking or retaining funds, and seek legal advice if an incident has already occurred.
The attacks occurred in 2022, Ahmed was arrested in 2023, and the sentence was imposed in 2024. This is a completed sentencing, not a new 2026 prosecution. The cited DOJ materials do not establish his current custody or release status.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
