Senior Amazon Security Engineer Faces Charges Over Cryptocurrency Theft Worth $9M

Updated: 12 July 2023

Disclosure

Don’t invest unless prepared to lose all the money you invest. This is a high-risk investment, you shouldn’t expect to be protected if something goes wrong.

Join Our Telegram channel to stay up to date on breaking news coverage

The U.S citizen and Manhattan, New York resident, Shakeeb Ahmed, aged 34, from Louisville, KY, has been charged with devising and executing a high-value cryptocurrency theft. This news comes as the Department of Justice in the Southern District of New York today indicted Ahmed, who was arrested in Manhattan.

Instead of using his role as a Senior Security Engineer at Amazon to secure digital assets, Ahmed stands accused of exploiting these systems for personal gain. The indictment accuses him of fraudulent manipulations and highlights an apparent trend of tech professionals misusing their expertise.

The indictment outlines two main charges against Ahmed:

Wire Fraud: Ahmed reportedly masterminded a fraud scheme to con Crema Finance and its users. The indictment suggests that Ahmed acquired cryptocurrency through deception by transmitting and instigating fraudulent information.
Money Laundering: He allegedly partook in financial activities with the unlawful proceeds and attempted to disguise the fraudulent nature, source, and ownership of these funds. This reportedly took place in July 2022.

The indictment further provides details of the methods used by Ahmed. It is alleged that he manipulated a loophole in a decentralized cryptocurrency exchange’s system, inputting fabricated pricing data to acquire inflated fees unlawfully. According to the document, Ahmed used his technical skills, including reverse-engineering smart contracts and blockchain audits, to execute the heist.

Used his Technical Expertise to Exploit Crypto Lending Platform

The indictment accuses Ahmed of creating fake “tick accounts,” designed to appear as legitimate accounts containing data about the liquidity provided by liquidity providers within a specific price range. By doing this, Ahmed is accused of tricking the exchange’s smart contract into generating inflated fees for him.

The charges go on to describe Ahmed’s tactic of taking out uncollateralized cryptocurrency “flash loans” worth tens of millions of dollars from a crypto lending platform. These loans were allegedly deposited into the exchange’s liquidity pools before being withdrawn. Ahmed then claimed an inflated proportion of the loans as fees, achieved through his deceptive use of the counterfeit tick accounts, and repaid the loans to the lender.

Following the heist, the indictment alleges that Ahmed laundered the stolen cryptocurrency through a series of transactions. These were designed to hide the origin and ownership of the funds, including token-swap transactions, transferring fraud proceeds from the Solana blockchain to the Ethereum blockchain, converting the fraud proceeds into Monero (a notoriously difficult to trace cryptocurrency), and using foreign crypto exchanges.

Ahmed’s negotiation efforts with the exchange after the theft are also detailed in the indictment. Despite an $800,000 offer from the exchange for the return of all stolen funds, Ahmed allegedly chose to retain a large portion of the stolen cryptocurrency, revealing his disregard for potential legal ramifications. He reportedly proposed to retain about $2.5 million of the stolen funds, eventually settling for around $1.5 million, after reducing his demand to $1.8 million.

The actions and decisions made by Ahmed highlight the challenges faced by technology companies when dealing with security breaches. They also suggest an unplanned nature of Ahmed’s actions and his inexperience in handling large sums of illicit funds. Despite his technical skills allowing him to exploit a complex decentralized cryptocurrency exchange, Ahmed’s actions post-attack showed a clear lack of understanding of digital privacy and law enforcement capabilities.