An Indiana man was sentenced to 20 years in federal prison for hacking into an investment holdings company’s servers and stealing more than $37 million worth of cryptocurrency.

According to court documents, the man, Evan Frederick Light, 22, used the stolen identity of a client of an investment holdings company in Sioux Falls, South Dakota, to access the servers and exfiltrate the personally identifiable information of hundreds of other clients.

Next, he used the stolen information to steal cryptocurrency from the 571 clients who held their assets with the investment holdings company, which has not been named.

To conceal the origin of the funds and to hide his identity, Light then transferred the stolen cryptocurrency to various locations worldwide, including mixing services and gambling websites.

The intrusion occurred in February 2022, and Light was arrested approximately one year later. He was indicted in June 2023 and pleaded guilty in September 2024.

In his guilty plea, Light admitted to working with co-conspirators to orchestrate the intrusion and to use various services to launder the money before storing it in a cold wallet.

Court testimonies show that Light and his co-conspirators used a false report of a kidnapping to have the investment holdings company’s employees evacuated so they could perpetrate the intrusion.

Light is believed to have stolen millions of dollars in cryptocurrency in a previous intrusion, bringing the total stolen amount to roughly $80 million, in today’s value.

In addition to the 20-year prison sentence, Light was ordered to pay a $200 special assessment. He will also be ordered to pay restitution, likely of at least $37 million, at a future hearing.

“From his mother’s basement in Indiana, Evan Light set out to steal millions of dollars in cryptocurrency, thereby destroying the retirement savings of hardworking, honest Americans. His 20-year sentence demonstrates the severity of his crime and its impact on the hundreds of victims whose lives have been devastated by his fraudulent activity,” US Attorney Alison J. Ramsdell said.

Related: Another NetWalker Ransomware Affiliate Gets 20-Year Prison Sentence in US

Related: Ukrainian Raccoon Infostealer Operator Sentenced to Prison in US

Related: Man Who Stole and Laundered Roughly $1B in Bitcoin Is Sentenced to 5 Years in Prison

Related: Idaho Man Sentenced to 10 Years in Prison for Hacking, Data Theft, Extortion