ShapeShift Alleges Former Employee Stole $900K in Bitcoin

Cryptocurrency company ShapeShift today filed a civil action in US District Court against Azamat Mukhiddinov, whom ShapeShift hired as a senior software engineer in August 2018.

The company accuses Mukhiddinov of accessing ShapeShift’s computer infrastructure to install a program that drip-fed Bitcoin from Shapeshift’s corporate account to an external wallet.

Between November 2019 and May 2020, Mukhiddinov allegedly managed to siphon approximately 90 bitcoin from ShapeShift’s corporate account to his own.

"Stated simply, someone had stolen, via electronic transfer, $900,000 worth of bitcoin from ShapeShift,” reads ShapeShift’s complaint, filed yesterday. In May, ShapeShift used “a tremendous amount of its internal and external resources” to work out the culprit.

It concluded that Mukhiddinov was to blame. (Decrypt has reached out to Mukhiddinov and ShapeShift CEO Erik Voorhees about the lawsuit and will update this article accordingly should we hear back.)

On May 25, ShapeShift says it confronted Mukhiddinov and that he admitted the theft, but told ShapeShift that he had spent some of the stolen Bitcoin and converted some of the money to US dollars.

“Accordingly, Azamat could not repay all of the approximately $900,000 in the form of bitcoin—some amount would need to be repaid in cash or in the form of other cryptocurrencies,” the complain reads.

According to the complaint, just hours after ShapeShift confronted him, Mukhiddinov handed over a duffle bag that contained $31,900 in US dollars and then wired 60 Bitcoin to ShapeShift. The rest came in dribs and drabs. “Eventually, Azamat returned, in one form or another, all of the $900,000 in bitcoin he had stolen,” said ShapeShift. 

But ShapeShift wants restitution for the costs of tracking him down. The alleged theft meant that ShapeShift employees had to stay late at the office to rewrite code, secure ShapeShift’s software and “generally undertake a thorough remediation of the Company’s computer networks, software, and infrastructure,” ShapeShift claimed.

This also diverted employees away “from other profitable tasks, duties, and projects, and had to temporarily bring its computer network and Internet-based services offline, thus impacting the Company’s ability to run its business and generate revenue,” said ShapeShift. It also caused ShapeShift to delay its flagship mobile app for two months.

“In total, ShapeShift’s costs and expenses relating to the investigation of Azamat’s theft and the repair of its effects totaled tens of thousands of dollars, if not more,” it said. Now it wants Mukhiddinov to pay it back.