{"investigation":{"slug":"nirvana-v1","entity_name":"Nirvana V1","trust_score":5,"severity_base":null,"score_modifier":0,"confidence":0.92,"status":"published","content_type":"investigation","summary":"Nirvana V1 was a Solana-based algorithmic stablecoin and yield protocol that operated twin tokens: ANA (an algorithmic metastable wealth token) and NIRV (a decentralized stablecoin). On July 28, 2022, the protocol was catastrophically exploited via a flash loan attack that drained approximately $3.5 million — representing nearly all protocol reserves — causing both tokens to collapse and forcing a permanent shutdown. The attacker, Shakeeb Ahmed, was later identified, arrested, and convicted in the first-ever U.S. criminal prosecution for hacking a smart contract, and was sentenced to three years in prison in April 2024.","sections":[{"content":"Nirvana V1 was a Solana-based DeFi protocol that described itself as a twin system of algorithmic wealth and ultra-low-risk stablecoin infrastructure. It issued two tokens: ANA, an algorithmic metastable token designed to function as a store of wealth with a rising floor price backed by protocol reserves; and NIRV, a decentralized stablecoin pegged to USD and backed by ANA-denominated reserves. The protocol employed a virtual automated market maker (vAMM) mechanism in which the ANA floor price was designed to ratchet upward as surplus reserves grew. Users could stake ANA to receive prANA rewards, generating compounding yield. At the time of its exploit, Nirvana V1 held approximately $3.5 million in reserves across its treasury pools. The protocol was closed-source and had not undergone a manual security audit prior to the exploit; only automated auditing had been completed.","heading":"Protocol Overview","sources":[{"url":"https://www.coindesk.com/tech/2022/07/28/solana-defi-protocol-nirvana-drained-of-liquidity-after-flash-loan-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/solana-based-stablecoin-nirv-drops-85-following-3-5m-exploit","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://ackee.xyz/blog/2022-solana-hacks-explained-nirvana/","name":"ackee.xyz","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 28, 2022, Nirvana V1 was drained of substantially all its liquidity in a flash loan attack. The attacker borrowed approximately 10 million USDC from Solend, a Solana-based lending protocol. Using a vulnerability in the ANA smart contract's pricing logic, the attacker manipulated inputs to the program and purchased ANA tokens at an artificially low price rather than the higher price the contract was designed to charge for large-volume purchases. Specifically, the attacker used the 'Buy 3' contract command, which caused the ANA price to be inflated from approximately $8 to $24. The attacker then immediately resold the ANA tokens back to Nirvana's treasury at the elevated price, receiving approximately 13.49 million USDT. After repaying the 10 million USDC flash loan to Solend, the attacker retained a net profit of approximately $3.49 million to $3.6 million. The stolen funds were subsequently bridged from Solana to Ethereum via the Wormhole cross-chain bridge and converted into DAI stablecoin. The attacker's Ethereum address (0xB9AE2624Ab08661F010185d72Dd506E199E67C09) held over $3.5 million in DAI at the time of initial reporting. CertiK's post-mortem identified the core vulnerability as the protocol's inability to prevent price oracle manipulation within a single atomic transaction, combined with insufficient input validation on the ANA pricing contract. Ackee Blockchain's analysis confirmed the protocol was closed-source and lacked a prior manual security audit, leaving the pricing flaw undetected.","heading":"Flash Loan Exploit — July 28, 2022","sources":[{"url":"https://www.certik.com/resources/blog/1UBzEHHu35dJdJOGsuf85D-nirvana-finance-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://ackee.xyz/blog/2022-solana-hacks-explained-nirvana/","name":"ackee.xyz","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2022/07/28/solana-defi-protocol-nirvana-drained-of-liquidity-after-flash-loan-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/solana-based-nirvana-loses-3-49m-to-flash-loan-exploit-tokens-tank-90/","name":"cryptoslate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The exploit caused immediate and irreversible collapse of both Nirvana V1 tokens. The ANA token fell over 80–85% within hours of the attack, while the NIRV stablecoin lost its USD peg, dropping to approximately 8 cents. Total value locked on the protocol plummeted to approximately 62 cents. Nirvana developers suspended the protocol's trading functions in the immediate aftermath and communicated via Telegram. The stolen $3.6 million represented approximately all funds possessed by Nirvana at the time, making recovery of the protocol's algorithmic mechanisms structurally impossible. Nirvana Finance shut down shortly after the attack. Nirvana subsequently offered the attacker a white-hat bug bounty of up to $600,000 in exchange for return of funds and cessation of any investigation, but the attacker rejected this offer and instead demanded $1.4 million. No agreement was reached and the attacker retained all stolen funds at the time. The protocol's Telegram announcement on July 28, 2022 stated: 'Please be advised: ANA has lost its collateral, and NIRV has lost its backing.'","heading":"Token Collapse and Protocol Shutdown","sources":[{"url":"https://cointelegraph.com/news/solana-based-stablecoin-nirv-drops-85-following-3-5m-exploit","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2022/07/28/solana-defi-protocol-nirvana-drained-of-liquidity-after-flash-loan-exploit","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cryptoslate.com/solana-based-nirvana-loses-3-49m-to-flash-loan-exploit-tokens-tank-90/","name":"cryptoslate.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In July 2023, the U.S. Department of Justice (Southern District of New York) arrested and charged Shakeeb Ahmed, 34, of New York, NY, in connection with the Nirvana V1 exploit and a separate, prior hack of another Solana-based decentralized exchange (subsequently identified in reporting as Crema Finance) that occurred on July 2–3, 2022. Ahmed was a senior security engineer at an international technology company at the time of both attacks; his resume reflected skills in reverse engineering smart contracts and blockchain audits. He was initially charged with wire fraud and money laundering, each carrying a maximum sentence of 20 years. The DOJ described the Nirvana prosecution as the first-ever U.S. criminal case involving an attack on a smart contract. On December 14, 2023, Ahmed pleaded guilty to one count of computer fraud before U.S. Magistrate Judge Ona T. Wang in the Southern District of New York. Under his plea agreement, Ahmed agreed to forfeit approximately $12.3 million and pay over $5 million in restitution to victims of both hacks. On April 12, 2024, Ahmed was sentenced to three years in federal prison plus three years of supervised release — marking the first ever conviction for the hack of a smart contract in U.S. legal history. Approximately $2.6 million was returned to Nirvana Finance in June 2024 following enforcement of the forfeiture order.","heading":"Criminal Prosecution — Shakeeb Ahmed","sources":[{"url":"https://www.justice.gov/usao-sdny/pr/former-security-engineer-sentenced-three-years-prison-hacking-two-decentralized","name":"justice.gov","type":"other","credibility":3},{"url":"https://www.justice.gov/usao-sdny/pr/former-security-engineer-international-technology-company-pleads-guilty-hacking-two","name":"justice.gov","type":"other","credibility":3},{"url":"https://www.theblock.co/post/267737/nirvana-finance-hacker-pleads-guilty-agrees-to-pay-restitution-to-victims","name":"theblock.co","type":"other","credibility":3},{"url":"https://www.coindesk.com/policy/2024/04/12/hacker-sentenced-to-3-years-in-prison-for-stealing-over-12m-from-crypto-exchanges","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.trmlabs.com/resources/blog/funds-returned-to-defi-exchange-nirvana-in-first-ever-defi-hack-prosecution","name":"trmlabs.com","type":"other","credibility":3},{"url":"https://blockworks.co/news/nirvana-hacker-pleads-guilty","name":"blockworks.co","type":"other","credibility":3}],"severity":"medium"},{"content":"Following Ahmed's sentencing and forfeiture, Nirvana Finance announced a V2 relaunch and compensation process for V1 victims in December 2024. Approximately $2.6 million was recovered and made available for pro-rata distribution to users who held ANA, NIRV, or prANA tokens at the time of the July 2022 hack, calculated based on each user's net equity (total holdings minus any NIRV debt) at the time of the exploit. Nirvana explicitly clarified that the V1 NIRV and ANA tokens would not be re-collateralized by any returned funds. Nirvana V2 opened to the public on December 17–18, 2024, and the protocol pledged 10% of all V2 fees to be distributed proportionally to V1 hack victims in perpetuity as additional restitution. The recovery represented partial restitution; the original exploit caused losses exceeding $3.5 million and the $2.6 million recovered represents a partial return. V1 ANA and NIRV tokens remain de-pegged and non-functional.","heading":"Victim Compensation and V2 Relaunch","sources":[{"url":"https://www.trmlabs.com/resources/blog/funds-returned-to-defi-exchange-nirvana-in-first-ever-defi-hack-prosecution","name":"trmlabs.com","type":"other","credibility":3},{"url":"https://defiteller.com/nirvana-finance-hack-recovery-and-investor-compensation","name":"defiteller.com","type":"other","credibility":3},{"url":"https://www.globenewswire.com/news-release/2024/12/16/2997825/0/en/Nirvana-Relaunches-After-Recovery-A-New-Vision-for-DeFi.html","name":"globenewswire.com","type":"other","credibility":3},{"url":"https://medium.com/nirvanafinance/nirvana-finance-rising-from-the-ashes-f2780607f685","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Nirvana V1 launched without a completed manual security audit. At the time of the exploit, the protocol had undergone only automated auditing. CertiK's post-mortem analysis identified the core vulnerability as the protocol's reliance on manipulable price inputs within its native AMM, which lacked sufficient safeguards against atomic price manipulation via flash loans. Ackee Blockchain confirmed that the closed-source nature of the codebase further limited community scrutiny of the pricing logic. The algorithmic design — in which treasury reserves directly backed token floor prices and were accessible via smart contract interactions — made the protocol structurally susceptible to the type of flash loan price manipulation used in the attack. The exploit drained 100% of protocol reserves in a single transaction, illustrating extreme concentration of treasury risk.","heading":"Security Audit Failures and Protocol Risk Factors","sources":[{"url":"https://www.certik.com/resources/blog/1UBzEHHu35dJdJOGsuf85D-nirvana-finance-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://ackee.xyz/blog/2022-solana-hacks-explained-nirvana/","name":"ackee.xyz","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-07-02","event":"Shakeeb Ahmed conducts first hack, exploiting Crema Finance (a separate Solana DEX) for approximately $9 million using fake pricing data to generate inflated fees via flash loans.","source":""},{"date":"2022-07-28","event":"Nirvana V1 flash loan exploit: Shakeeb Ahmed drains approximately $3.5–3.6 million from Nirvana Finance treasury using price manipulation on the ANA smart contract. Stolen funds bridged to Ethereum via Wormhole and converted to DAI.","source":""},{"date":"2022-07-28","event":"Nirvana Finance suspends trading. ANA token falls over 85%; NIRV stablecoin depegs to approximately $0.08. Protocol announces loss of all collateral via Telegram.","source":""},{"date":"2022-07-28","event":"Nirvana Finance offers attacker a white-hat bounty of up to $600,000 in exchange for return of funds. Attacker counter-demands $1.4 million. No agreement reached.","source":""},{"date":"2022-08","event":"Nirvana Finance shuts down permanently following loss of all treasury reserves.","source":"","date_original":"2022-08-01"},{"date":"2023-07-11","event":"U.S. DOJ (SDNY) arrests Shakeeb Ahmed and charges him with wire fraud and money laundering related to both the Crema Finance and Nirvana Finance hacks. Case described as first-ever U.S. criminal prosecution for hacking a smart contract.","source":""},{"date":"2023-12-14","event":"Shakeeb Ahmed pleads guilty to one count of computer fraud before U.S. Magistrate Judge Ona T. Wang (SDNY). Agrees to forfeit $12.3 million and pay over $5 million in restitution.","source":""},{"date":"2024-04-12","event":"Shakeeb Ahmed sentenced to 3 years in federal prison plus 3 years supervised release. Ordered to forfeit $12.3 million and pay restitution of over $5 million. First-ever criminal conviction for hacking a smart contract.","source":""},{"date":"2024-06-04","event":"Approximately $2.6 million returned to Nirvana Finance following enforcement of forfeiture order, as confirmed by TRM Labs.","source":""},{"date":"2024-12-17","event":"Nirvana Finance V2 launches publicly. Team opens compensation claims for V1 hack victims based on pro-rata share of recovered $2.6 million. Protocol pledges 10% of V2 fees to V1 victims in perpetuity.","source":""}],"sources_used":[{"url":"https://www.justice.gov/usao-sdny/pr/former-security-engineer-sentenced-three-years-prison-hacking-two-decentralized","name":"DOJ SDNY — Former Security Engineer Sentenced To Three Years In Prison For Hacking Two Decentralized Cryptocurrency Exchanges","type":"regulatory","archive_url":"http://web.archive.org/web/20260524074423/https://www.justice.gov/usao-sdny/pr/former-security-engineer-sentenced-three-years-prison-hacking-two-decentralized","credibility":1,"archive_timestamp":"2026-05-24T07:44:23+00:00"},{"url":"https://www.justice.gov/usao-sdny/pr/former-security-engineer-international-technology-company-pleads-guilty-hacking-two","name":"DOJ SDNY — Former Security Engineer Pleads Guilty To Hacking Two Decentralized Cryptocurrency Exchanges","type":"regulatory","archive_url":"http://web.archive.org/web/20260524101100/https://www.justice.gov/usao-sdny/pr/former-security-engineer-international-technology-company-pleads-guilty-hacking-two","credibility":1,"archive_timestamp":"2026-05-24T10:11:00+00:00"},{"url":"https://www.coindesk.com/tech/2022/07/28/solana-defi-protocol-nirvana-drained-of-liquidity-after-flash-loan-exploit","name":"CoinDesk — Solana DeFi Protocol Nirvana Drained of Liquidity After Flash Loan Exploit","type":"news_article","archive_url":"http://web.archive.org/web/20260720152724/https://www.coindesk.com/tech/2022/07/28/solana-defi-protocol-nirvana-drained-of-liquidity-after-flash-loan-exploit","credibility":2,"archive_timestamp":"2026-07-20T15:27:24+00:00"},{"url":"https://www.coindesk.com/policy/2024/04/12/hacker-sentenced-to-3-years-in-prison-for-stealing-over-12m-from-crypto-exchanges","name":"CoinDesk — Hacker Sentenced to 3 Years in Prison for Stealing Over $12M From Crypto Exchanges","type":"news_article","archive_url":"https://web.archive.org/web/20260724173231/https://www.coindesk.com/policy/2024/04/12/hacker-sentenced-to-3-years-in-prison-for-stealing-over-12m-from-crypto-exchanges","credibility":2,"archive_timestamp":"2026-07-24T17:32:31+00:00"},{"url":"https://cointelegraph.com/news/solana-based-stablecoin-nirv-drops-85-following-3-5m-exploit","name":"CoinTelegraph — Solana-based stablecoin NIRV drops 85% following $3.5M exploit","type":"news_article","archive_url":"http://web.archive.org/web/20251219160812/https://cointelegraph.com/news/solana-based-stablecoin-nirv-drops-85-following-3-5m-exploit","credibility":2,"archive_timestamp":"2025-12-19T16:08:12+00:00"},{"url":"https://cryptoslate.com/solana-based-nirvana-loses-3-49m-to-flash-loan-exploit-tokens-tank-90/","name":"CryptoSlate — Solana-based Nirvana loses $3.5M to flash loan exploit; tokens tank 90%","type":"news_article","archive_url":"http://web.archive.org/web/20260720152722/https://cryptoslate.com/solana-based-nirvana-loses-3-49m-to-flash-loan-exploit-tokens-tank-90/","credibility":2,"archive_timestamp":"2026-07-20T15:27:22+00:00"},{"url":"https://www.certik.com/resources/blog/1UBzEHHu35dJdJOGsuf85D-nirvana-finance-incident-analysis","name":"CertiK — Nirvana Finance Incident Analysis","type":"research","archive_url":"https://web.archive.org/web/20260726133020/https://www.certik.com/blog/1UBzEHHu35dJdJOGsuf85D-nirvana-finance-incident-analysis","credibility":2,"archive_timestamp":"2026-07-26T13:30:20+00:00"},{"url":"https://ackee.xyz/blog/2022-solana-hacks-explained-nirvana/","name":"Ackee Blockchain — 2022 Solana Hacks Explained: Nirvana","type":"research","archive_url":"http://web.archive.org/web/20260724170203/https://ackee.xyz/blog/2022-solana-hacks-explained-nirvana/","credibility":2,"archive_timestamp":"2026-07-24T17:02:03+00:00"},{"url":"https://www.theblock.co/post/267737/nirvana-finance-hacker-pleads-guilty-agrees-to-pay-restitution-to-victims","name":"The Block — Nirvana Finance hacker pleads guilty, agrees to pay restitution to victims","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/288108/ex-security-engineer-gets-three-years-for-first-ever-smart-contract-hacking-conviction-stole-12-million-in-crypto","name":"The Block — Ex-security engineer gets three years for first-ever smart contract hacking conviction","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blockworks.co/news/nirvana-hacker-pleads-guilty","name":"Blockworks — Nirvana Finance hacker pleads guilty, forfeits $12.3M","type":"news_article","archive_url":"http://web.archive.org/web/20260221041159/https://blockworks.co/news/nirvana-hacker-pleads-guilty","credibility":2,"archive_timestamp":"2026-02-21T04:11:59+00:00"},{"url":"https://blockworks.com/news/nirvana-finance-hacker-sentenced","name":"Blockworks — Nirvana hacker sentenced to 3 years after pleading guilty","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.trmlabs.com/resources/blog/funds-returned-to-defi-exchange-nirvana-in-first-ever-defi-hack-prosecution","name":"TRM Labs — Funds Returned to DeFi Exchange Nirvana in First Ever DeFi Hack Prosecution","type":"research","archive_url":"http://web.archive.org/web/20260421004228/https://www.trmlabs.com/resources/blog/funds-returned-to-defi-exchange-nirvana-in-first-ever-defi-hack-prosecution","credibility":2,"archive_timestamp":"2026-04-21T00:42:28+00:00"},{"url":"https://defiteller.com/nirvana-finance-hack-recovery-and-investor-compensation","name":"DeFiTeller — Nirvana Finance Hack Recovery: Investor Compensation and Legal Outcome","type":"news_article","archive_url":"http://web.archive.org/web/20260725123518/https://defiteller.com/nirvana-finance-hack-recovery-and-investor-compensation","credibility":3,"archive_timestamp":"2026-07-25T12:35:18+00:00"},{"url":"https://www.globenewswire.com/news-release/2024/12/16/2997825/0/en/Nirvana-Relaunches-After-Recovery-A-New-Vision-for-DeFi.html","name":"GlobeNewswire — Nirvana Relaunches After Recovery: A New Vision for DeFi","type":"official","archive_url":"http://web.archive.org/web/20260725161203/https://www.globenewswire.com/news-release/2024/12/16/2997825/0/en/Nirvana-Relaunches-After-Recovery-A-New-Vision-for-DeFi.html","credibility":2,"archive_timestamp":"2026-07-25T16:12:03+00:00"},{"url":"https://medium.com/nirvanafinance/nirvana-finance-rising-from-the-ashes-f2780607f685","name":"Medium — Nirvana Finance: Rising from the Ashes (V2 announcement)","type":"official","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:48.772265+00:00","updated_at":"2026-08-29T01:33:23.463+00:00"}}