Evan Frederick Light, a 22-year-old man from Indiana, has been sentenced to 20 years in federal prison for hacking into an investment holdings company and stealing more than $37 million in cryptocurrency.
In February 2022, Light targeted an unnamed investment firm based in Sioux Falls, South Dakota, using the stolen identity of a client to breach the company’s servers. Once inside, he exfiltrated personal data of hundreds of other clients, then proceeded to steal cryptocurrency from 571 accounts.
To cover his tracks, Light used a combination of techniques, including mixing services and online gambling platforms, to obscure the origins of the stolen funds. He then transferred the cryptocurrency to various locations around the globe before ultimately storing it in a cold wallet.
Light, who worked with co-conspirators, used a false kidnapping report to evacuate the company’s employees, which allowed him to carry out the heist with minimal interference. Authorities believe Light may have been involved in a previous crypto theft, bringing his total haul to nearly $80 million in stolen cryptocurrency.
He was arrested in 2023, indicted later that year, and pleaded guilty in September 2024. In addition to the 20-year prison sentence, Light faces a $200 special assessment and will be ordered to pay restitution, likely of at least $37 million, in a future hearing.
U.S. Attorney Alison J. Ramsdell stated, “From his mother’s basement in Indiana, Evan Light set out to steal millions of dollars in cryptocurrency, thereby destroying the retirement savings of hardworking, honest Americans. His sentence demonstrates the severity of his crime and its devastating impact on the victims.”
This case underscores the growing threat of cybercrime and the far-reaching consequences of stealing digital assets.
