Nirvana Finance hacker pleads guilty, forfeits $12.3M

Charges against Shakeeb Ahmed were announced back in July

article-image

Artwork by Crystal Le

share

The Nirvana Finance hacker pleaded guilty in New York on Thursday.

Shakeeb Ahmed was connected to two hacks — Nirvana and another decentralized exchange. In 2022, DeFi protocol Nirvana was hacked for roughly $3.5 million in a flash loan exploit.

The crypto exchange attacked by Ahmed was left unnamed in the press release announcing his guilty plea. However, when the US Department of Justice first announced the charges against Ahmed, Blockworks reported that the references matched an attack made on Crema Finance in July 2022.

As part of today’s plea, Ahmed forfeited $12.3 million. Nearly $6 million of the sum in crypto. 

The plea marks the first time that the DOJ convicted someone for hacking smart contracts.

Read more: Following the money: How the SDNY caught the Crema hacker

“Five months ago, my Office announced the first ever arrest involving an attack on a smart contract. Today, senior security engineer Shakeeb Ahmed pled guilty and agreed to return all of the stolen crypto to his victims,” US attorney Damian Williams said in a press release.

The charges, announced in July, only linked Ahmed to the hacking of a crypto exchange. 

“Ahmed’s plea has also resulted in him further admitting that he carried out a previously unsolved second multi-million-dollar hack, this time of decentralized finance protocol Nirvana Finance.” 

“In the days after the hack of Nirvana, Ahmed conducted internet searches for the term ‘defi hacks prosecution’ and searches related to the charges in the Indictment, including the terms “wire fraud” and “evidence laundering,” the DOJ said.

The DOJ said that Ahmed attacked the exchange in July 2022 by exploiting a smart contract vulnerability. From there, he was able to generate roughly $9 million and withdraw those fees.

Read more: ‘Wallet drainer’ code added to Ledger library has crypto on edge

“After he stole the fees he never legitimately earned, Ahmed had communications with the Crypto Exchange in which he agreed to return all of the stolen funds except for $1.5 million if the Crypto Exchange agreed not to refer the attack to law enforcement,” the DOJ said. 

Ahmed also took to Google in an attempt to avoid legal action, using the search engine to look up “how to stop federal government from seizing assets” and also tried to research how to buy citizenship. 

Ahmed will pay $5 million in restitution to his victims, and will be sentenced in March 2024.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Unlocked by Template (10).png

Research

Innovations on Aptos’ technical design through Raptr, Shardines, and Zaptos approach near-optimal latency and throughput by unlocking 100% utilization of network resources, with the capacity to settle 260k transactions per second with latencies less than 800ms. The original Move language was revamped with the launch of Move 2, supporting more expressivity in smart contract logic and a scalable ability to interact with high volume datasets. The ecosystem has benefitted from strong asset inflows, now hosting over $1.3B in stablecoins, $450M in bridged BTC, and $530M in RWAs. Activity in the Aptos ecosystem has grown notably over the past year, with monthly application revenue reaching ~$835k and monthly DEX volumes growing to over $5B, both at new all time highs.

article-image

The Stripe-acquired firm has big plans for a streamlined, multi-wallet future

article-image

Both founders of the former crypto lender have now landed in new crypto industry roles

article-image

Bitcoin’s recent peak is a victory lap for curvers left and right

article-image

Securitize CEO Carlos Domingo says institutions are eager to get exposure to tokenization

article-image

Trade isn’t war and prosperity isn’t a contest