Nirvana Finance hacker pleads guilty, forfeits $12.3M

Charges against Shakeeb Ahmed were announced back in July


Artwork by Crystal Le


The Nirvana Finance hacker pleaded guilty in New York on Thursday.

Shakeeb Ahmed was connected to two hacks — Nirvana and another decentralized exchange. In 2022, DeFi protocol Nirvana was hacked for roughly $3.5 million in a flash loan exploit.

The crypto exchange attacked by Ahmed was left unnamed in the press release announcing his guilty plea. However, when the US Department of Justice first announced the charges against Ahmed, Blockworks reported that the references matched an attack made on Crema Finance in July 2022.

As part of today’s plea, Ahmed forfeited $12.3 million. Nearly $6 million of the sum in crypto. 

The plea marks the first time that the DOJ convicted someone for hacking smart contracts.

Read more: Following the money: How the SDNY caught the Crema hacker

“Five months ago, my Office announced the first ever arrest involving an attack on a smart contract. Today, senior security engineer Shakeeb Ahmed pled guilty and agreed to return all of the stolen crypto to his victims,” US attorney Damian Williams said in a press release.

The charges, announced in July, only linked Ahmed to the hacking of a crypto exchange. 

“Ahmed’s plea has also resulted in him further admitting that he carried out a previously unsolved second multi-million-dollar hack, this time of decentralized finance protocol Nirvana Finance.” 

“In the days after the hack of Nirvana, Ahmed conducted internet searches for the term ‘defi hacks prosecution’ and searches related to the charges in the Indictment, including the terms “wire fraud” and “evidence laundering,” the DOJ said.

The DOJ said that Ahmed attacked the exchange in July 2022 by exploiting a smart contract vulnerability. From there, he was able to generate roughly $9 million and withdraw those fees.

Read more: ‘Wallet drainer’ code added to Ledger library has crypto on edge

“After he stole the fees he never legitimately earned, Ahmed had communications with the Crypto Exchange in which he agreed to return all of the stolen funds except for $1.5 million if the Crypto Exchange agreed not to refer the attack to law enforcement,” the DOJ said. 

Ahmed also took to Google in an attempt to avoid legal action, using the search engine to look up “how to stop federal government from seizing assets” and also tried to research how to buy citizenship. 

Ahmed will pay $5 million in restitution to his victims, and will be sentenced in March 2024.

Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the On the Margin newsletter.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.


Upcoming Events

Salt Lake City, UT

MON - TUES, OCT. 7 - 8, 2023

Blockworks and Bankless in collaboration with buidlbox are excited to announce the second installment of the Permissionless Hackathon – taking place October 7-8 in Salt Lake City, Utah. We’ve partnered with buidlbox to bring together the brightest minds in crypto for […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

Unlocked by Template.png


With the spot ETH ETF approval, the institutions are coming. stETH - given its dominance in marketshare, existing liquid market structures, and highly desirable properties - is poised for institutions.


Plus, the rise of RWAs could bring about a significant shift in how real-world investments are managed and accessed


The distributed cell plan provider started selling its own hotspots in October 2023


The Brazil-based asset manager’s filing comes during a year of milestone bitcoin and ether fund approvals


The purchase of five sites in Georgia set to help CleanSpark hit its mid-year operating hash rate target of 20 EH/s


Plus, it’s beginning to look like we may be in for a cruel summer



Engaging with XDC provides access to cutting-edge financial tools and places investors at the forefront of the trade finance revolution