Shakeeb Ahmed, a computer security engineer residing in New York, has been indicted by the U.S. Attorney’s Office for the Southern District of New York for allegedly scamming a decentralized cryptocurrency exchange out of $9 million. Although the indictment does not disclose the name of the exchange, it closely resembles the circumstances of the Crema Finance hack that occurred in July 2022, and which operated on the Solana blockchain.
Ahmed purportedly took advantage of a vulnerability within a smart contract of the decentralized exchange (DEX), allowing him to manipulate pricing data in a fraudulent manner. This manipulation led to the generation of inflated fees, which accumulated to around $9 million. Additionally, he is alleged to have used “flash loans” as a means to defraud the exchange further. This involved borrowing substantial amounts of money, depositing the funds into the DEX’s liquidity pool, and subsequently withdrawing the funds while claiming a significant percentage as fees.
According to the indictment, Ahmed is accused of making elaborate attempts to launder the stolen funds through intricate transfers across various blockchains and international exchanges. In his efforts, he allegedly tried to bridge the funds from Solana to Ethereum and even converted the illicit proceeds into Monero, a cryptocurrency renowned for its strong anonymity and challenging traceability.
Of particular interest, just two days after the attack, Ahmed performed internet searches related to “DeFi hack” and read news articles about his own illicit activity. His search history also revealed queries about “wire fraud” and “evidence laundering.” Notably, Ahmed seemed to explore potential escape plans, conducting searches regarding his ability to leave the United States, evade extradition, and safeguard his stolen assets. Among his searches were phrases such as “can I cross the border with crypto,” “how to prevent federal government from seizing assets,” and “buying citizenship.”
After the cyberattack, it has been reported that Ahmed made a proposition to the decentralized exchange (DEX) involved. He allegedly offered to return the majority of the stolen funds, while keeping $1.5 million for himself, on the condition that the DEX refrained from reporting the incident to law enforcement. In addition, Ahmed’s proposal included providing insights to the DEX regarding their technical weaknesses and vulnerabilities.
This instance comes in the wake of another Department of Justice (DOJ) indictment involving blockchain fraud in the same week, this time connected to non-fungible tokens (NFTs). Ahmed now confronts charges of wire fraud and money laundering, which carry a potential maximum prison sentence of 20 years.
