Mentioned in This Article
1. Holograph HLG hack sentence: what the Paris court decided
On November 6, 2026, the Paris tribunal judiciaire sentenced a former Holograph Foundation employee, identified as Vitaliy K., to five years in prison for the unauthorized minting and transfer of 1 billion HLG tokens, valued at roughly $14 million when the theft took place. Two of the five years must be served, three are suspended, and he was fined €600,000.
The ruling closes a criminal case that began with an exploit of the Holograph token in 2024. The court did not treat the matter as a novel crypto offense. Instead, it applied long-standing provisions of French criminal law to conduct carried out on a blockchain, a point that gives the verdict relevance well beyond one project.
The sentence has a split structure that is common in French criminal practice. A portion of the term is served in custody, while the remainder is suspended, meaning it hangs over the defendant and can be imposed if conditions are later breached. The €600,000 fine is a separate financial penalty on top of the prison term.
The decision is notable for another reason: it was delivered in a court that sits at the heart of the French justice system, in a case that links a Cayman Islands foundation, a token running on a public blockchain and defendants prosecuted in France. Few crypto thefts reach a final judgment at all, which makes a completed trial with named convictions comparatively rare.
2. Which charges led to the conviction?
Vitaliy K. was found guilty on four counts: unauthorized access to an automated data processing system, organized fraud, money laundering and participation in a criminal association. Together, the counts describe a scheme in which the defendant first gained a way to alter how tokens could be created, then used that ability to produce a large supply, and finally moved the proceeds in order to disguise where they came from.
The court found that between May and August 2024 the rules governing the minting of HLG, the Holograph token, were illegally changed. That change made it possible to generate and take 1 billion tokens. At the time, the haul was worth about €12.5 million, or roughly $14 million.
He did not act alone. The court convicted two accomplices as well, and both received lighter punishments than the main defendant. One was fined €80,000 and the other €40,000, and their prison terms were reduced or suspended in part. The difference in sentences reflects the court's view of Vitaliy K. as the central figure in the scheme.
Each count addresses a different part of the conduct. Unauthorized access to a data processing system covers the initial interference with how the token's minting worked. Organized fraud captures the use of that interference to obtain assets that did not belong to the defendants. Money laundering covers the effort to move and conceal the proceeds, and the criminal association charge reflects that several people took part in a coordinated effort rather than a single person acting in isolation.
3. Why did the court reject the foundation's compensation claim?
The court dismissed the Holograph Foundation's request for compensation tied to the fall in HLG's price. The judges based the decision on causation: the token had already lost a large share of its value before the fraudulent acts were committed, and the court saw no direct link between the crime and the losses the foundation described.
Price history helps explain that reasoning. HLG traded at around $0.03 in May 2024, the month the court says the illegal changes began. By late December 2024 it had dropped to $0.001. Because a substantial decline was already under way before the offense, a claim that the theft alone destroyed the token's value was difficult to support.
For the foundation, the outcome is a significant setback. A conviction establishes that a crime was committed, but it does not by itself guarantee that a court will convert falling market prices into a damages award. Civil recovery requires proof that specific losses flowed from specific misconduct, and the judges concluded that this standard was not met for the price-related claim.
The ruling also draws a line between two questions that are often blurred in public discussion of crypto thefts. One question is whether a crime occurred and who is responsible. The other is how much financial harm the victim can legally attribute to that crime. The court answered the first firmly, with prison terms and fines, while giving a narrower answer to the second.
4. What is Holograph and what happened in the 2024 exploit?
The Holograph Foundation is incorporated in the Cayman Islands. It developed cross-chain tools for tokens and NFTs, meaning technology that lets digital assets move between different blockchains. Projects of this kind rely on smart contracts and permissions that define who can create, move or burn tokens, which makes those permissions a critical point of control.
In July 2024, Holograph and the security firm Halborn published a post-mortem on an exploit involving 1 billion HLG tokens on the Mantle network. The report attributed the incident to a disgruntled former contractor. That description fits the broader pattern the court later examined: a person with legitimate familiarity with the system used it to change how minting worked, rather than breaking in through a flaw that outsiders had found.
Minting is the act of creating new units of a token. In a healthy token system, the ability to mint is tightly restricted, often to a governance process or a small set of authorized keys, because every new token dilutes the holdings of everyone else. When someone obtains unauthorized minting power, the damage is not limited to the tokens they take. Holders of the existing supply see their stake diluted, and markets tend to react to the sudden appearance of a much larger supply.
Cross-chain infrastructure adds a further layer of complexity. Because such tools connect separate networks, a weakness in permissions can affect assets on more than one chain, and a bad actor with the right access can influence how tokens are issued or recognized in several places. This is one reason security teams treat administrative privileges at bridging and interoperability projects with particular care.
5. How long did the case take to reach a verdict?
Italian authorities arrested a suspect in September 2024, only a few months after the exploit became public. The prosecution that concluded in Paris came more than two years after that arrest, a timeline that shows how slowly cross-border crypto cases can move even when suspects are identified early.
Cases of this type often involve investigators in several countries, because the people involved, the exchanges that received the tokens and the infrastructure used to move them can sit in different jurisdictions. Tracing transfers across blockchains and exchange accounts, then assembling evidence that a court will accept, takes time. The Paris verdict shows that such efforts can end in a conviction, even if the process is lengthy.
The foundation itself has not fared well in the meantime. It has stalled its business operations and is preparing for liquidation, which means the organization that built the cross-chain tools is winding down while the criminal case reaches its conclusion.
Investigations of this kind also depend on cooperation between police forces and prosecutors. An arrest in one country, a trial in another and a token whose records are visible to anyone on a public ledger all have to be brought together into a case that stands up before judges. The fact that the verdict arrived in Paris after an arrest in Italy illustrates that kind of cross-border handoff.
6. What does the verdict mean for HLG holders and crypto projects?
For holders of HLG, the outlook is bleak. A foundation heading toward liquidation is unlikely to restore the token's value, and the court's refusal to award compensation removes one possible source of funds that might have supported a recovery. The token's fall from about $0.03 to $0.001 during 2024 is not something the verdict reverses.
The case also underlines the risk posed by insiders. Smart contract audits are designed to confirm that code behaves as written. They are far less effective when a person with legitimate access changes the rules themselves. Projects that depend on privileged keys or administrative roles therefore face a threat that technical reviews alone cannot remove, and that tends to call for strict access controls, separation of duties and monitoring of any change to minting permissions.
Another lesson concerns transparency. Because public blockchains record every mint and every transfer, a rule change followed by a large issuance leaves a visible trail. That record can help investigators reconstruct what happened long after the fact, and it is part of what allowed a court to describe the period from May to August 2024 as the window in which the illegal changes took place. At the same time, visibility on a ledger does not prevent the theft in the first place, and the market had little chance to react before the damage was done.
For other projects, the practical takeaway is that governance and security design must account for the people who build and maintain a system, not only for outside attackers. Reducing reliance on a single person's access, requiring several approvals for sensitive changes and promptly removing permissions when staff or contractors leave are all measures that address the type of threat described in this case.
The legal approach matters too. Prosecutors relied on conventional offenses such as fraud, money laundering and unauthorized system access instead of a statute written specifically for digital assets. That suggests existing criminal law can reach insiders who abuse crypto systems, without waiting for new legislation.
Finally, the causation ruling may influence later disputes. Courts may hesitate to award damages for price declines that began before the crime occurred. Projects hoping to recover losses through civil claims may need clearer evidence tying particular market losses to particular misconduct. In this case, the story ends with a conviction, a foundation preparing to liquidate and a token that lost most of its value.