Evan Frederick Light, a 22-year-old Indiana man, has been sentenced to 20 years in federal prison for hacking into an investment holdings company’s servers
and stealing over $37 million in cryptocurrency. According to court documents, Light used the stolen identity of a client from a Sioux Falls, South Dakota-based company to gain unauthorized access to its servers. Once inside, he exfiltrated the personally identifiable information (PII) of hundreds of other clients and subsequently stole cryptocurrency from 571 account holders.
To conceal the origins of the stolen funds and his identity, Light transferred the cryptocurrency to various locations worldwide, including mixing services and gambling websites. The attack took place in February 2022, and Light was arrested about a year later. He was indicted in June 2023 and pleaded guilty in September 2024.
In his guilty plea, Light admitted to working with co-conspirators to orchestrate the intrusion and laundering the stolen funds before storing them in a cold wallet. Court records also revealed that Light and his accomplices used a false kidnapping report to force the evacuation of company employees, creating the opportunity to execute the hack.
Authorities believe Light was involved in previous cyber intrusions, bringing the estimated total of stolen cryptocurrency to roughly $80 million in today’s value. In addition to his prison sentence, he has been ordered to pay a $200 special assessment, with restitution expected to be at least $37 million to be determined at a future hearing.
“From his mother’s basement in Indiana, Evan Light set out to steal millions of dollars in cryptocurrency, thereby destroying the retirement savings of hardworking, honest Americans. His 20-year sentence demonstrates the severity of his crime and its impact on the hundreds of victims whose lives have been devastated by his fraudulent activity,” U.S. Attorney Alison J. Ramsdell stated.
