A senior security engineer admitted hacking decentralized finance protocol Nirvana Finance and an unnamed Solana exchange — agreeing to forfeit $12 million in profits and pay victims $5 million in restitution.

34-year old Shakeeb Ahmed pleaded guilty to wire fraud and money laundering charges tied to two orchestrated DeFi exploits in 2022 likely earning over $16 million combined based on details revealed.

Prosecutors said Ahmed discovered and ruthlessly exploited vulnerabilities in smart contracts powering both platforms last spring. Nirvana offered a $600,000 bounty to have its funds returned, but Ahmed demanded $1.4 million instead.

Authorities eventually identified Ahmed as the perpetrator of both attacks despite efforts concealing tracks through crypto mixing, token swapping across blockchains, and overseas exchange laundering.

The high-profile case marks the first federal conviction ever for a DeFi protocol hack. Ahmed faces up to 5 years in prison when sentenced in March — the culmination of a months-long investigation into code vulnerabilities that drained millions.

While terms provide some recompense, lingering questions surround auditing failures allowing a single actor to repeatedly breach defenses through basic flaws endangering user funds. Trust assumptions in smart contract security absorb yet another blow.