Nirvana Finance hacker agrees to forfeit $12.3 million

The hacker responsible for the breach of Nirvana Finance’s yield-farming protocol and an unnamed DEX, pleaded guilty and agreed to forfeit the stolen assets worth $12.3 million.

According to U.S. prosecutors, in the summer of 2022, 34-year-old senior security engineer Shakib Ahmed exploited a vulnerability in the smart contract of an unnamed exchange. A few weeks later he attacked Nirvana Finance using a flash loan and moved $3.49 million in cryptocurrency from the project’s treasury.

Although the protocol’s developers offered the hacker a bounty, the parties failed to reach an agreement. The stolen funds were converted into Monero and passed through the Samourai Whirlpool mixer.

In July, Ahmed was charged with electronic fraud and money laundering.

In addition to confiscating the stolen cryptocurrency, he was ordered to pay victims $5 million in compensation.

The final sentence in the case is due on March 13; Ahmed faces up to five years in prison.

As reported, part of the funds stolen from Nirvana Finance moved through the decentralized exchange THORSwap. In October 2023, after investigators flagged potentially illicit transactions, the platform temporarily switched its interface to maintenance mode.