Former security engineer arrested in NY after allegedly defrauding a DeFi exchange, stealing $9 million

A former security engineer was arrested on Tuesday morning over what law enforcement says is the “first criminal case” involving an attack on a smart contract that was operated by a decentralized exchange. 

Shakeeb Ahmed, 34, was charged with wire fraud and money laundering after the U.S. Attorney’s Office for the Southern District of New York said he defrauded an unnamed decentralized crypto exchange, stealing about $9 million in crypto.

“We also allege that he then laundered the stolen funds through a series of complex transfers on the blockchain where he swapped cryptocurrencies, hopped across different crypto blockchains, and used overseas crypto exchanges, Damian Williams, the U.S. attorney for the Southern District of New York, in a statement. "But none of those actions covered the defendant’s tracks or fooled law enforcement, and they certainly didn’t stop my Office or our law enforcement partners from following the money.”

In July 2022, Ahmed exploited “a vulnerability” in one of the exchange’s smart contracts and put in false pricing data which led the smart contract to “generate approximately $9 million dollars’ worth of inflated fees that Ahmed did not legitimately earn,” law enforcement said.

Afterwards, Ahmed told the exchange, which operates on the Solana blockchain, that he would return all of the funds, except for $1.5 million, if it didn’t go to law enforcement, according to the statement. 

'Can I cross border with crypto?'

Ahmed allegedly searched online to find out more information about the attack and criminal liability. He also read news articles about the hack. 

“Ahmed also conducted internet searches or visited websites related to his ability to flee the United States, avoid extradition, and keep his stolen cryptocurrency: he searched for the terms 'can I cross border with crypto,' 'how to stop federal government from seizing assets,' and 'buying citizenship'; and he visited a website titled '16 Countries Where Your Investments Can Buy Citizenship,'" according to the attorney’s office. 

Wire fraud and money laundering each carry a maximum sentence of 20 years in prison. 

The U.S. Attorney’s Office for the Southern District of New York also separately charged Soufiane Oulahyane, 25, with fraud over an alleged scheme to impersonate the OpenSea marketplace to get access to crypto and NFTs, stealing $450,000 worth in the process. 

“This is the second case we are announcing this week to shed light on fraud in the cryptocurrency and digital asset ecosystem,” Williams said on Tuesday after announcing the charges against Ahmed.