MSTR Cat

Crypto Law/Level VI · Market conduct/6.2 Insiders and rugs/Lesson 6

Hacks and exploits as theft

Why ‘the code allowed it’ has not stopped US prosecutors from charging smart-contract exploits as computer fraud, wire fraud and money laundering, and where the courts have pushed back.

Education, not legal, tax or investment advice. Crypto law differs between countries and states and changes often. Check the current rules where you live with a qualified lawyer or tax adviser before you act.

The lean path

The cheapest, lowest-tax, simplest and most private route the law allows, best first. Each step names the rule it rests on and the condition that keeps it lawful.

  1. Builders: the cheapest legal protection is an incident plan written before launch, naming who preserves logs and hashes, records attacker addresses, and contacts IC3, stablecoin issuers and exchanges. Reporting costs nothing; delay costs freeze opportunities.
  2. A victim protocol can bring a civil claim under 18 U.S.C. §1030(g) for compensatory damages and an injunction, alongside any criminal case. Catch: it must be filed within 2 years of the act or of discovering the damage.
  3. No cheap lawful route exists for keeping exploited funds: ‘the code allowed it’ did not stop Ahmed’s 2024 sentence of three years and about $12.3 million forfeiture. The lawful alternative is reporting the flaw under a published bug bounty.
  4. Never receive or move funds traced to an exploit or to sanctioned actors, such as those the FBI linked to the February 2025 Bybit theft. Screening against OFAC’s free sanctions list costs nothing; civil sanctions penalties are generally strict liability.

Materials18 U.S.C. §1030, the Computer Fraud and Abuse Act (on law.cornell.edu)The US Attorney’s April 2024 release on Shakeeb Ahmed’s sentence and the February 2025 release on the Medjedovic indictmentThe FBI’s public service announcement of 26 February 2025 on the Bybit theftLessons 6.1.4 (front-running and MEV) and 6.1.5 (the Mango Markets case)

Wonder

  1. If a smart contract let me withdraw the funds, how can taking them be theft?
  2. Which federal laws do prosecutors use against DeFi exploiters?
  3. What can a protocol or its users do after an exploit besides call the police?

Explore

  1. Some exploiters argue that a smart contract is the whole agreement, so whatever its code permits is allowed. US prosecutors have rejected that view. They charge exploits under the Computer Fraud and Abuse Act, 18 U.S.C. §1030, which among other things punishes knowingly accessing a protected computer without authorisation, or exceeding authorised access, with intent to defraud; under the wire fraud statute, 18 U.S.C. §1343, where the exploit relies on deception such as fake prices or manipulated inputs; and under money laundering laws when proceeds are bridged, mixed or swapped to hide them. Courts are still testing where these lines fall.
  2. The first conviction for hacking a smart contract came in the Southern District of New York. Shakeeb Ahmed, a senior security engineer whose resume listed smart-contract reverse engineering and blockchain audits, used fake pricing data in July 2022 to generate about $9 million in inflated fees on one decentralised exchange. Weeks later he exploited Nirvana Finance, taking about $3.6 million, roughly all its funds; Nirvana shut down soon after. He laundered proceeds through bridges, Monero and mixers. He pleaded guilty to one count of computer fraud in December 2023.
  3. On 12 April 2024 Judge Victor Marrero sentenced Ahmed to three years in prison and three years of supervised release, ordered forfeiture of about $12.3 million and a significant quantity of cryptocurrency, and ordered restitution of over $5 million to the two victims. In February 2025 prosecutors in the Eastern District of New York unsealed an indictment of Andean Medjedovic, a Canadian, for wire fraud, computer hacking, attempted extortion and money laundering. They allege he used borrowed funds to create artificial prices and drained about $65 million from KyberSwap and Indexed Finance pools. He was at large when charged.
  4. Not every prosecution has held. Avraham Eisenberg’s fraud and manipulation convictions over Mango Markets were set aside by the trial judge in May 2025, partly because the evidence did not show a false statement; the government’s appeal is covered in lesson 6.1.5. The case of Anton and James Peraire-Bueno, accused of taking about $25 million in 12 seconds through Ethereum’s block-building process, ended in a mistrial in November 2025 (lesson 6.1.4). For builders the message is mixed: exploits are routinely charged, but how far fraud law reaches ‘manipulative’ trading against code is still being decided.
  5. Criminal law is only one track. The Computer Fraud and Abuse Act lets a person who suffers qualifying damage or loss bring a civil action for compensatory damages and an injunction, 18 U.S.C. §1030(g). Stablecoin issuers and exchanges can freeze assets they control. State actors raise sanctions issues: on 26 February 2025 the FBI attributed the theft of about $1.5 billion from the Bybit exchange on or about 21 February 2025 to North Korea, which it calls ‘TraderTraitor’, and urged services to block related addresses. Anyone handling such funds faces sanctions exposure (lesson 5.2.5).
  6. A practical response plan for builders is worth writing before launch. It should say who preserves logs and transaction hashes, who records attacker addresses, and who contacts the FBI’s IC3, the affected stablecoin issuers and major exchanges. It should also set out who may speak to the attacker and what may be offered (lesson 6.2.7). Do not promise anyone immunity from prosecution; a private protocol cannot give it. Users should know that knowingly receiving or moving stolen funds can itself be charged as money laundering, whatever an exploiter says about code.

Key facts

  • 18 U.S.C. §1030(a)(4) punishes knowingly accessing a protected computer without authorisation, or exceeding authorised access, with intent to defraud and thereby obtaining anything of value.
  • Shakeeb Ahmed pleaded guilty to one count of computer fraud in December 2023 in what prosecutors called the first conviction for hacking a smart contract.
  • On 12 April 2024 Ahmed was sentenced to three years in prison and ordered to forfeit about $12.3 million and pay over $5 million in restitution.
  • In February 2025 prosecutors in the Eastern District of New York charged Andean Medjedovic with wire fraud, computer hacking, attempted extortion and money laundering over about $65 million taken from KyberSwap and Indexed Finance.
  • 18 U.S.C. §1030(g) lets a person who suffers qualifying damage or loss from a violation sue for compensatory damages and injunctive relief.
  • On 26 February 2025 the FBI attributed the theft of about $1.5 billion from the Bybit exchange to North Korean actors it calls ‘TraderTraitor’.

Exercise nine, six, three, one

9CollectList up to 9 things a person might say to justify taking funds through a smart-contract bug (some lists are shorter), such as ‘the code allowed it’, ‘it was arbitrage’ or ‘I planned to give it back’.
6ClusterSort them into 6 categories: arguments about authorisation, about deception, about intent to return, about market fairness, about who the victim was, and arguments that are only excuses.
3DistillReduce the 6 categories to 3 groups: arguments courts have taken seriously, arguments prosecutors have rejected, and arguments still being tested.
1CrystallizeWrite 1 sentence explaining, in your own words, why a smart contract permitting a transaction does not settle whether the transaction was lawful.

Fact check

Dates, figures and claims checked against the published sources listed below.

Open in the interactive academy →

PT ES ZH JA KO RU DE FR MS