An Indiana man has pleaded guilty to involvement in a cyber intrusion at a financial services firm in Sioux Falls, South Dakota. This attack led to the theft of personal information from clients and the appropriation of nearly $38 million in cryptocurrency from 571 victims.

According to his plea agreement, 21-year-old Evan Light from Lebanon, Indiana, along with unnamed accomplices, managed to breach the company's servers by stealing the identity of one of its clients. They misused this client’s information to unlawfully access the company's systems and execute the theft.

After the incident, Light pleaded guilty to money laundering, having funneled the stolen funds through various mixing services and online gambling platforms to hide his identity as well as that of his co-conspirators. He also acknowledged wiring the proceeds and storing them in a cold wallet under his control.

"These convictions reflect the relentless efforts of the U.S. Attorney’s Office and the FBI in identifying a cybercriminal, holding him accountable, and prioritizing the victims of his crimes," stated U.S. Attorney Alison Ramsdell in a Tuesday press release. "Although this defendant tried to hide in the shadows of a cyber underworld, he was not beyond the reach of our team, and today’s guilty verdicts should serve as a reminder that this Office and its law enforcement partners will bring cyber criminals to justice, regardless how sophisticated their crimes may be."

The theft occurred in February 2022. Following the theft, the FBI raided Light’s home in May 2023—around two weeks after he was indicted by a grand jury on charges of conspiracy to commit wire fraud and conspiracy to launder monetary instruments.

Both charges carry a maximum penalty of 20 years, implicating that Light could face up to 40 years in prison. Sentencing has yet to be scheduled.