Shakeeb Ahmed, a senior security engineer affiliated with an international technology company, has pleaded guilty to computer fraud in connection with the hacking of two decentralized cryptocurrency exchanges. The guilty plea, announced by Damian Williams, the United States Attorney for the Southern District of New York, is significant as it marks the first-ever conviction for hacking a smart contract.

The charges stem from the July 2022 hacks on two exchanges, one referred to as the “crypto exchange,” and the other associated with the decentralized finance (DeFi) protocol Nirvana Finance. At the time of the attacks, Ahmed, a 34-year-old US citizen, served as a senior security engineer with specialized skills in reverse engineering smart contracts and conducting blockchain audits.

In the first attack on the crypto exchange, Ahmed exploited a vulnerability in the smart contracts, leading to the fraudulent generation of approximately $9 million in trading fees. After the theft, Ahmed engaged in discussions with the exchange, offering to return most of the stolen funds if the exchange refrained from involving the police.

The second attack targeted Nirvana Finance, where Ahmed used a flash loan to secure approximately $10 million, manipulated Nirvana’s smart contracts, and profited around $3.6 million. Despite Nirvana’s bug bounty offer, Ahmed demanded $1.4 million, leading to the closure of Nirvana after he retained all stolen funds.

Following the attacks, Ahmed employed intricate laundering techniques, including token-swap transactions, bridging fraud proceeds between blockchains, and converting funds into the privacy coin Monero (XMR).

Ahmed pleaded guilty to one count of computer fraud, which carries a maximum sentence of five years in prison. As part of the plea agreement, he agreed to forfeit over $12.3 million, including about $5.6 million worth of stolen crypto. Ahmed is scheduled for sentencing on March 13, 2024, before United States District Judge Victor Marrero.