An Indiana man has pleaded guilty to taking part in the “cyber intrusion” of a Sioux Falls, South Dakota-based financial services company, during which he and unnamed co-conspirators hacked into the company’s servers, stole customers’ personal information, and then stole nearly $38 million in cryptocurrency from 571 victims.

According to his plea agreement, 21-year-old Evan Light, of Lebanon, Indiana, and his unnamed co-conspirators were able to infiltrate the unnamed company’s servers after stealing the identity of one of its clients. They then used that client’s information to illegally gain access to the company’s servers and carry out the theft.

After the theft, Light pleaded guilty to laundering the group’s ill-gotten gains, funneling them through “multiple mixing services and gambling websites” to conceal his identity and the identities of his co-conspirators. He also pleaded guilty to wiring the proceeds and then storing them in a cold wallet under his control.

“These convictions reflect the relentless efforts of the U.S. Attorney’s Office and the FBI in identifying a cybercriminal, holding him accountable, and prioritizing the victims of his crimes,” said U.S. Attorney Alison Ramsdell in a Tuesday press release. “Although this defendant tried to hide in the shadows of a cyber underworld, he was not beyond the reach of our team, and today’s guilty verdicts should serve as a reminder that this Office and its law enforcement partners will bring cyber criminals to justice, regardless how sophisticated their crimes may be.”

The theft took place in February 2022. According to a local news outlet, the FBI raided Light’s residence, which he shared with his mother, in May 2023, approximately two weeks after he was indicted by a grand jury for conspiracy to commit wire fraud and conspiracy to launder monetary instruments.

Both counts carry a maximum sentence of 20 years, meaning Light faces up to 40 years in prison. No date has yet been set for Light’s sentencing.