- A ‘grey hat’ hacker is wanted by US authorities for hacking Crema Finance in 2022
- Shakeeb Ahmed stole $9 million but offered to return all but $1.5 million as long as he wasn’t reported to the police
- Ahmed conducted internet searches on escaping with stolen funds after the hack
A former security engineer for Amazon was yesterday accused of hacking the Crema Finance decentralized exchange for $9 million in the first case of its kind in the US. In an announcement yesterday, the United States Attorney for the Southern District of New York unsealed first-of-its-kind charges against Shakeeb Ahmed for hacking the decentralized exchange and manipulating the pricing data to give him the windfall. Ahmed gave back all but $1.5 million of the funds in a deal with the exchange but is wanted for the act, sending a warning to all ‘grey hat’ hackers that informal deals with exchanges don’t mean much in the real world.
Ahmed Used Flash Loans to Inflate Fees
In July 2022, Ahmed defrauded Crema Finance by exploiting a vulnerability in one of its smart contracts. By inserting fabricated pricing data, Ahmed fraudulently caused the smart contract to generate approximately $9 million worth of inflated fees which he withdrew before engaging in communications with Crema Finance. During these exchanges, he offered to return all the stolen funds, except for $1.5 million, on the condition that the Crypto Exchange refrained from reporting the attack to law enforcement.
Ahmed, then a security engineer for Amazon, laundered his stolen millions through different methods, such as conducting token-swap transactions, bridging the funds to the Ethereum blockchain, converting them into Monero, and utilizing overseas cryptocurrency exchanges.
Google, How Do I Escape With Stolen Money?
Following the attack, Ahmed didn’t help himself by enlisting the help of Google to escape with the funds, conducting searches to gather information regarding the attack, his own criminal liability, criminal defense attorneys specializing in similar cases, law enforcement’s ability to investigate the attack successfully, and methods to evade criminal charges by leaving the United States.
These inadvisable searches included “defi hack,” “wire fraud,” and “evidence laundering” while he also looked up terms like “can I travel across borders with crypto,” “how to prevent the federal government from seizing assets,” and “acquiring citizenship.”
As a result of his actions, Ahmed has been charged with wire fraud and money laundering, each of which carry a maximum sentence of 20 years in prison. The indictment marks the first time the US has taken such action against a hacker of a decentralized exchange, but it almost certainly won’t be the last.
