PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchShakeeb Ahmed, a former senior security engineer, was sentenced in the United States to three years in prison after pleading guilty to exploiting two decentralized-finance platforms and taking more than $12 million in cryptocurrency. The sentence, imposed on April 12, 2024, also included three years of supervised release, approximately $12.3 million in forfeiture and more than $5 million in restitution.
The case is significant because the Southern District of New York described it as the first U.S. conviction involving the hacking of a smart contract. It also shows why taking funds first and offering to return them for a fee is not the same as conducting authorized security research.
As an Amazon Associate I earn from qualifying purchases.
What happened in the two crypto attacks?
Ahmed carried out two attacks in July 2022. According to the Justice Department’s account, the first occurred on July 2 and 3 and generated approximately $9 million in fraudulent fees. The second occurred on July 28 and involved Nirvana Finance, where Ahmed obtained approximately $3.6 million.
The combined amount was more than $12 million, although the individual figures were approximate. The first exchange was not named in the Justice Department’s public releases. Contemporary reporting linked it to Crema Finance, a Solana-based decentralized exchange, but that identification should be treated as reported rather than as an explicit government confirmation.
#1 Best Overall
The first attack: manipulated pricing data
In the first incident, Ahmed exploited a vulnerability in a decentralized exchange’s smart contract. He inserted or caused the use of false pricing data, leading the contract to calculate roughly $9 million in fees that he had not legitimately earned. He then withdrew those fees in cryptocurrency.
A smart contract is software deployed on a blockchain that automatically applies rules for trading, lending, pricing or settlement. If those rules accept unvalidated or attacker-controlled data, the contract can execute a transaction that is technically valid on the blockchain but economically fraudulent.
After the attack, Ahmed offered to return the funds minus $1.5 million if the exchange agreed not to report the incident to law enforcement. Prosecutors treated that proposed payment and confidentiality condition as part of the criminal conduct, not as a normal bug bounty.
The Nirvana Finance attack: a flash loan and price manipulation
Nirvana Finance operated a DeFi protocol involving its ANA token. The protocol was designed to adjust ANA’s price when users bought or sold substantial quantities.
Ahmed obtained a flash loan of approximately $10 million. A flash loan allows someone to borrow a large amount of capital without conventional collateral, provided the loan is borrowed and repaid within the same blockchain transaction.
He exploited a weakness in Nirvana’s smart-contract logic to buy ANA at its lower initial price instead of the higher price intended for a large purchase. After the protocol updated the price, he sold the tokens back at the higher value. His reported profit was approximately $3.6 million.
Nirvana offered a bounty of up to $600,000 for the return of the funds. Ahmed instead demanded approximately $1.4 million and kept the stolen cryptocurrency. The loss represented approximately all of Nirvana’s funds, and the protocol shut down shortly afterward.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhy this was not an ordinary bug bounty
Security researchers can legitimately report vulnerabilities under a company’s published bug-bounty rules or a specific agreement. Those programs generally define what may be tested, prohibit taking customer funds and set the reward in advance.
Rank #3
The conduct described in Ahmed’s case was different:
- Responsible disclosure: identifying and reporting a weakness without taking unauthorized funds.
- Bug bounty: receiving a preauthorized reward under defined rules.
- Post-theft demand: taking funds without permission and conditioning their return on payment or silence.
Some crypto-industry commentary has used terms such as “white hat” for attackers who return funds after an exploit. But technical skill or a later offer to return money does not itself create authorization. The legal question includes how the funds were obtained, whether permission existed and what the defendant did afterward.
How investigators followed the money
The Justice Department said Ahmed attempted to conceal the proceeds through token swaps, transfers between the Solana and Ethereum blockchains, conversions into Monero, overseas cryptocurrency exchanges and mixers including Samourai Whirlpool.
That does not mean every blockchain investigation will identify a suspect, or that privacy-focused tools are always traceable. It does show the difference between pseudonymity and anonymity: blockchain addresses may not display a person’s name, but transaction histories can still be analyzed across chains and services and combined with other evidence.
The prosecution and sentence
Federal prosecutors announced the initial charges on July 11, 2023. The indictment alleged wire fraud and money laundering, offenses that carried potential maximum penalties of up to 20 years each according to the Justice Department’s arrest announcement.
Ahmed pleaded guilty to computer fraud on December 14, 2023 and acknowledged responsibility for both attacks. Computer fraud carried a statutory maximum of five years in prison. On April 12, 2024, he received:
- Three years in prison;
- Three years of supervised release after imprisonment;
- Forfeiture of approximately $12.3 million, plus a significant quantity of cryptocurrency; and
- More than $5 million in restitution to the unnamed exchange and Nirvana.
The three-year prison term was therefore only one part of the punishment. Forfeiture is intended to strip criminal proceeds or equivalent assets from the defendant, while restitution is directed toward compensating victims. They are separate figures and should not be treated as interchangeable with the approximate amount stolen.
Recommended Free Tools
What money was recovered?
The court’s forfeiture and restitution orders are different from later reports about particular assets being returned. In June 2024, blockchain intelligence company TRM Labs reported that approximately $2.6 million in cryptocurrency had been returned to Nirvana.
Best Value
That reported recovery should not be described as proof that all stolen funds were returned. Nor should it be added mechanically to the court’s forfeiture figure. The headline amount, the forfeiture order, restitution and later asset recovery describe different stages of the case.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why the conviction matters for DeFi
The Southern District of New York called the case the first U.S. conviction for an attack on a smart contract. That is a government characterization, not an independently exhaustive claim about every prosecution worldwide.
Its broader importance is clearer:
- Automated financial code can be the instrument of a fraud prosecution.
- A transaction being accepted by a blockchain does not establish that it was authorized.
- Professional security expertise does not provide a defense to unauthorized use of that expertise.
- Returning some money, or offering to return it, does not automatically erase the underlying offense.
- Concealment and laundering activity can create additional criminal exposure.
For personal-finance readers, the case is also a reminder that “decentralized” does not mean risk-free. DeFi users may face smart-contract, liquidity, oracle, governance and counterparty risks even when no traditional bank is involved.
What remains unconfirmed or easy to misunderstand?
- Identity of the first victim: DOJ releases called it “the Crypto Exchange.” Crema Finance was identified by contemporary reporting, but not named in the cited sentencing release.
- Exact total stolen: the reported components were approximately $9 million and $3.6 million, so “more than $12 million” is more precise than “exactly $12 million.”
- Employment history: some reports described Ahmed as a former Amazon engineer. DOJ releases described him more generally as a senior security engineer at an international technology company.
- Recovery: the reported $2.6 million return to Nirvana is not the same as total restitution or forfeiture.
- “First” conviction: the first-conviction claim should be attributed to the Southern District of New York rather than expanded into a worldwide claim.
Security lessons for DeFi platforms
No single control can guarantee that a smart contract will be safe, but the case illustrates several areas developers should address:
- Use robust, manipulation-resistant oracle designs.
- Keep fee calculations separate from untrusted or weakly validated pricing inputs.
- Test economic invariants and abnormal market conditions, not just code coverage.
- Model flash-loan and same-transaction attacks before deployment.
- Consider transaction limits, slippage protections, withdrawal caps, circuit breakers and emergency pause controls where appropriate.
- Use independent audits while recognizing that an audit is not a security guarantee.
- Publish a clear vulnerability-disclosure and bounty policy before an incident occurs.
- Preserve transaction traces, logs and communications, and coordinate quickly with counsel, exchanges, investigators and law enforcement after an exploit.
These are general defensive measures, not proof that any one of them would have prevented Ahmed’s attacks. The central lesson is that DeFi security is both a technical and governance problem: code must resist manipulation, and organizations need a lawful process for handling discoveries when something goes wrong.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
