Is there clear case law on what crimes or liabilities a party commits by using a logical bug in software (i.e. bitcoin) to move funds to themselves?
Yes — but the answer is a little more interesting than “there's a law against exploiting bugs.”
There is now a pretty direct U.S. precedent that deliberately exploiting a software bug in a crypto smart contract to extract funds can constitute a federal crime. But there is not yet a clean Supreme Court/appeals-level rule saying that any use of a logical bug to cause a protocol to transfer assets is theft.
The distinction matters enormously.
The clearest case: United States v. Ahmed
In 2022, Shakeeb Ahmed exploited vulnerabilities in two decentralized exchanges' smart contracts. In the Nirvana Finance attack, he discovered a flaw that allowed him to buy tokens for less than the contract was supposed to charge, then immediately sell them back at the higher price, extracting about $3.6 million.
That's almost exactly the hypothetical you're describing: the protocol's own code executed the transaction; Ahmed supplied inputs that caused the buggy logic to transfer value to him.
He pled guilty to computer fraud and was sentenced to 3 years in prison, plus forfeiture of about $12.3 million and restitution. DOJ explicitly described it as the first conviction for hacking a smart contract.
So “but the smart contract itself authorized the transaction” is emphatically not a guaranteed defense.
However, Ahmed's case was a guilty plea, so we don't have an appellate judicial opinion carefully deciding why the conduct constituted computer fraud.
John
npub1hj…2zg68
2026-09-07 21:07:49 UTC
Author Public Key
npub1hjlev3xn736aqr4ecmjxwwzuu9k523kp5fpz9n862s4lwah2h22sm2zg68Published at
2026-09-07 21:07:49 UTCEvent JSON
{
"id": "0000d9c5eb420eaf3040405a7b343706ea25d161d9011eb374e216dc80d42973",
"pubkey": "bcbf9644d3f475d00eb9c6e467385ce16d4546c1a24222ccfa542bf776eaba95",
"created_at": 1788815269,
"kind": 1,
"tags": [
[
"client",
"Dark Wisp"
],
[
"nonce",
"80826",
"16"
]
],
"content": "Is there clear case law on what crimes or liabilities a party commits by using a logical bug in software (i.e. bitcoin) to move funds to themselves? \n\nYes — but the answer is a little more interesting than “there's a law against exploiting bugs.”\n\nThere is now a pretty direct U.S. precedent that deliberately exploiting a software bug in a crypto smart contract to extract funds can constitute a federal crime. But there is not yet a clean Supreme Court/appeals-level rule saying that any use of a logical bug to cause a protocol to transfer assets is theft.\n\nThe distinction matters enormously.\n\nThe clearest case: United States v. Ahmed\nIn 2022, Shakeeb Ahmed exploited vulnerabilities in two decentralized exchanges' smart contracts. In the Nirvana Finance attack, he discovered a flaw that allowed him to buy tokens for less than the contract was supposed to charge, then immediately sell them back at the higher price, extracting about $3.6 million.\n\nThat's almost exactly the hypothetical you're describing: the protocol's own code executed the transaction; Ahmed supplied inputs that caused the buggy logic to transfer value to him.\n\nHe pled guilty to computer fraud and was sentenced to 3 years in prison, plus forfeiture of about $12.3 million and restitution. DOJ explicitly described it as the first conviction for hacking a smart contract. \n\nSo “but the smart contract itself authorized the transaction” is emphatically not a guaranteed defense.\n\nHowever, Ahmed's case was a guilty plea, so we don't have an appellate judicial opinion carefully deciding why the conduct constituted computer fraud.",
"sig": "789366307a63327fbc761c17a5d54cac23256d8c81d1362b443341d99147ec0009d441f9398635133ea189000512f09a66c747227b04d96c83ad4d9551a5e29e"
}