US Man Pleads Guilty to $37 Million Crypto Theft and Data Breach

Key Takeaways

• Light now faces a potential sentence of up to 20 years in prison for each charge
• He breached an investment firm’s servers to steal customer data and used it to steal crypto from users.

A 21-year-old man from Indiana, Evan Frederick Light, has pleaded guilty to charges connected to a significant cryptocurrency theft that resulted in over $37 million in losses. The case involves nearly 600 victims and stems from a data breach at an investment company based in Sioux Falls, South Dakota, in February 2022.

Light admitted to conspiracy charges for wire fraud and money laundering during a hearing on September 30. According to a statement from the U.S. Attorney’s Office in South Dakota, Light and his accomplices illegally accessed the company’s servers, retrieving sensitive personal information, including login details and cryptocurrency wallet keys. Using this data, they targeted clients’ cryptocurrency holdings and siphoned off substantial amounts of digital assets.

As per the Department of Justice,  the man breached an investment firm’s computer servers to unlawfully access customer information and used it to steal crypto from the clients who held digital assets at the firm 

To cover his tracks, Light funnelled the stolen crypto through various online platforms, including mixers and gambling websites, aimed at obscuring the origin of the funds. Despite his efforts to evade authorities, Light was charged in June 2023 and initially pleaded not guilty before changing his plea in court.

The Department of Justice (DOJ) revealed that the crimes spanned from 2021 until May 2023. Light now faces a potential sentence of up to 20 years in prison for each charge, alongside financial penalties, restitution, and forfeiture of illicit gains. Authorities noted that the investigation continues, with at least one additional perpetrator involved.

“Although this defendant tried to hide in the shadows of a cyber underworld, he was not beyond the reach of our team,” the DOJ said in a statement following the guilty plea. “This case demonstrates that no matter how sophisticated the crime, cybercriminals will be brought to justice.”

The breach occurred at an investment holdings firm in Sioux Falls, South Dakota, when Light and others exploited security weaknesses to access customer data. 

In a report released last month, the FBI’s Internet Crime Complaint Center noted that crypto fraud accounted for $5.6 billion in losses in 2023, with nearly 69,000 public complaints filed, up from 48,000 complaints in 2022.

Light’s sentencing is expected to take place at a later date, with the possibility of substantial prison time and financial penalties as the court considers the scope of the crime.