U.S. charges Solana attackers with money laundering, first law enforcement action of its kind

The U.S. Attorney for the Southern District of New York called the case "the first criminal case involving an attack on a smart contract operated by a decentralized exchange."

The U.S. Attorney for the Southern District of New York (SDNY) announced in a July 11 press release that it is charging Shakeeb Ahmed, a senior security engineer at an unidentified company, with money laundering using the unnamed Solana. July 2022-based protocol, which marks the first time the U.S. government has charged a decentralized exchange with smart contract attacks.

Ahmed allegedly used the Solana exchange’s smart contracts to manipulate the platform’s price data and incur $9 million in inflated fees. Ahmed allegedly used flash loans during the attack and used his skills in reverse engineering smart contracts and blockchain audits.

Ahmed allegedly attempted to negotiate with cryptocurrency exchanges after withdrawing the stolen funds in cryptocurrency. He offered to return all but $1.5 million of the stolen funds as long as the exchange did not report the incident to law enforcement.

Officials noted that this marks the first criminal case involving a smart contract attack on a decentralized exchange.

Although SDNY did not identify the targeted exchange, the dates, amounts stolen, and references to Solana closely match the 2022 attack on Crema Finance.

Defendant failed to cover his tracks

Ahmed employed a variety of methods to launder the stolen fees and obscure his transactions, officials said. He allegedly conducted token swaps, bridging transactions between Solana (SOL) and Ethereum (ETH), converted funds into privacy coin Monero (XMR), and traded them on overseas cryptocurrency exchanges.

U.S. Attorney Damian Williams said Ahmed could not have concealed his activities. Any actions by the defendant "covered his tracks or fooled law enforcement," Williams said, adding that authorities were able to trace the movement of funds.

Ahmed now faces up to 20 years in prison on charges of wire fraud and money laundering. As with all criminal cases, Ahmed is presumed innocent until proven guilty in court.

On July 10, the SDNY charged another individual with a deception scheme that resulted in the theft of $450,000 worth of cryptocurrencies and NFTs via OpenSea, a case officials acknowledged in their latest announcement as another example of cryptocurrency fraud.