Security engineer admits guilt in Nirvana Finance hack and another cyber attack

First-ever conviction for hacking a smart contract

A software engineer has pleaded guilty to computer fraud charges in relation to the hacking of Nirvana Finance and an unnamed decentralized cryptocurrency exchange. Shakeeb Ahmed, a senior security engineer for an international technology company, was arrested in July for his involvement in the hack. The United States Attorney’s Office stated that this was the first-ever conviction for hacking a smart contract.

$9 million in inflated fees generated

The attack on the unnamed exchange involved Ahmed exploiting a vulnerability in one of the exchange's smart contracts. By inserting fake pricing data, Ahmed fraudulently caused the contract to generate approximately $9 million worth of inflated fees. However, Ahmed returned all but $1.5 million to the exchange, which agreed not to involve law enforcement.

Nirvana Finance flash loan exploit

Following his arrest, Ahmed admitted to another cyber attack known as the Nirvana Finance flash loan exploit. This exploit resulted in Ahmed stealing $3.49 million. Nirvana Finance offered Ahmed a $300,000 white-hat bounty for the return of the hacked funds. However, Ahmed sold all of the ANA coins for a profit, leading to the closure of Nirvana Finance.

Covering his tracks

Ahmed used various techniques to cover his tracks and launder the stolen funds. He swapped stolen cryptocurrencies for Monero, utilized cryptocurrency mixers, hopped across blockchains, and utilized overseas crypto exchanges. In total, Ahmed stole over $12 million.

Sentencing and release on bail

Ahmed, a U.S. citizen and resident of New York City, was released on bail after being charged in July. His sentencing is scheduled for March 13, 2024.