{"investigation":{"slug":"kyberswap","entity_name":"KyberSwap","trust_score":55,"severity_base":null,"score_modifier":17,"confidence":0.87,"status":"published","content_type":"investigation","summary":"KyberSwap is a multi-chain decentralized exchange aggregator and concentrated liquidity protocol operated by Kyber Network. On November 22, 2023, its Elastic liquidity pool contracts were exploited via a sophisticated tick-manipulation and liquidity double-counting attack, resulting in approximately $48.8 million in losses across 13 chains. The alleged attacker, Canadian national Andean Medjedovic, subsequently attempted to extort full corporate and governance control of Kyber Network in exchange for returning 50% of stolen funds; he was indicted by the U.S. Department of Justice in February 2025 and remains a fugitive.","sections":[{"content":"KyberSwap is a decentralized exchange (DEX) aggregator and automated market maker (AMM) protocol developed by Kyber Network, a Singapore-based blockchain company co-founded by Loi Luu, Victor Tran, and Yaron Velner. The platform operates across more than 17 blockchain networks and offers multiple liquidity products, including KyberSwap Elastic, a concentrated liquidity protocol analogous to Uniswap v3. Prior to the November 2023 exploit, KyberSwap Elastic had total value locked (TVL) of approximately $80 million. KyberSwap's native governance token, KNC (Kyber Network Crystal), is used in the KyberDAO governance framework. By 2025 the platform had processed over $100 billion in cumulative trading volume since inception.","heading":"Overview and Platform Background","sources":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"blog.kyberswap.com","type":"other","credibility":3},{"url":"https://blog.kyberswap.com/kyberswap-2025-recap-a-year-of-momentum-at-scale/","name":"blog.kyberswap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 22, 2023, an attacker exploited a critical vulnerability in KyberSwap Elastic's concentrated liquidity smart contracts, draining approximately $48.8 million from 77 liquidity pools. An additional $6.6 million was extracted by front-running bots that detected the attack in progress, bringing the total to approximately $55.2 million. The exploit affected deployments on Arbitrum ($20 million), Optimism ($15 million), Ethereum ($7 million), and several other chains including BSC, Avalanche, Polygon, Fantom, Base, Scroll, Linea, Polygon zkEVM, BitTorrent, and Cronos. The primary attacker address identified is 0x50275E0B7261559cE1644014d4b78D4AA63BE836. KyberSwap's TVL collapsed from approximately $80 million to $22.23 million immediately following the attack, a drop of over 72%.","heading":"November 2023 Elastic Pool Exploit","sources":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"blog.kyberswap.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2023/11/23/kyberswap-dex-hacked-for-48-million-attacker-teases-negotiations","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","name":"halborn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Security researchers described the attack mechanism as one of the most technically sophisticated DeFi exploits on record. The root cause was a precision error and arithmetic inconsistency within KyberSwap Elastic's computeSwapStep() function. When a swap was crafted such that its amount was just below the threshold needed to cross a tick boundary, the updateLiquidityAndCrossTick function was not triggered. This created a state mismatch: the pool's internal baseL (base liquidity) variable was not decremented when the price moved back through the tick, causing the protocol to double-count liquidity. The attacker exploited this by using a flash loan of approximately 10,000 wstETH (worth roughly $23 million), executing a sequence of carefully calculated swaps and artificial position minting to drive prices into low-liquidity ranges, trigger the mismatch condition, and then extract far more tokens than were deposited. Security firms including BlockSec, Halborn, and SlowMist independently described the vulnerability as involving 'slightly different arithmetic' between two functions that should have been consistent, and classified the resulting condition as a type of precision-loss or rounding-error exploit, not a reentrancy attack. CertiK and multiple other auditing firms had previously reviewed the KyberSwap Elastic code without identifying this specific vulnerability.","heading":"Technical Vulnerability: Tick Manipulation and Liquidity Double-Counting","sources":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"blog.kyberswap.com","type":"other","credibility":3},{"url":"https://blocksec.com/blog/kyberswap-incident-masterful-exploitation-of-rounding-errors-with-exceedingly-subtle-calculations","name":"blocksec.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3305d3a","name":"slowmist.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Shortly after the exploit, the attacker posted on-chain messages taunting the Kyber Network team, stating 'negotiations will start in a few hours when I am fully rested' and asking 'how is Ontario this time of year.' On November 30, 2023, the attacker — referring to themselves as 'Kyber Director' — posted a detailed on-chain ransom letter with demands described by observers as extraordinary in scope. The alleged demands included: complete executive control over Kyber Network; full temporary authority over the KyberDAO governance mechanism; and access to all internal company documents covering structure, revenue, expenses, salaries, assets, liabilities, and investor information, as well as forfeiture of all company IP and social media assets. In exchange, the attacker offered to serve as the company's new leader, buy out current executives at 'fair valuation,' double salaries for non-executive employees who remained, and provide 12-month severance for those who departed. The deadline for compliance was stated as December 10, 2023. The attacker warned that any government contact would void the arrangement. Kyber Network did not comply with these demands. The DOJ subsequently characterized the settlement proposal as a 'sham' in its February 2025 indictment.","heading":"Attacker Extortion Demands","sources":[{"url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter","name":"decrypt.co","type":"other","credibility":3},{"url":"https://www.bankinfosecurity.com/cryptohack-roundup-kyberswap-hacker-demands-control-a-23733","name":"bankinfosecurity.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","name":"coindesk.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On February 3, 2025, the U.S. Attorney's Office for the Eastern District of New York (EDNY) unsealed a federal indictment against Andean Medjedovic, a 22-year-old Canadian national from Waterloo, Ontario, charging him with five counts: wire fraud, unauthorized damage to a protected computer (Computer Fraud and Abuse Act), attempted Hobbs Act extortion, money laundering conspiracy, and money laundering. The indictment alleges Medjedovic stole approximately $65 million across two DeFi protocols: $16 million from Indexed Finance in 2021, and approximately $48.8 million from KyberSwap in 2023. Prosecutors allege Medjedovic spent months planning the KyberSwap attack, with notes that included the phrase 'Find time to Strike.' The maximum combined penalty for all charges is 90 years imprisonment. Investigation was conducted jointly by the FBI, IRS Criminal Investigation (IRS-CI), and Homeland Security Investigations (HSI). The Netherlands had previously issued a European arrest warrant for Medjedovic in December 2023.","heading":"DOJ Indictment: Andean Medjedovic","sources":[{"url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes","name":"justice.gov","type":"other","credibility":3},{"url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","name":"coindesk.com","type":"other","credibility":3},{"url":"https://hackread.com/canadian-charged-kyberswap-indexed-finance-defi-hack/","name":"hackread.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Andean Medjedovic has been at large since a Canadian court issued an arrest warrant in December 2021 following the Indexed Finance exploit. He has publicly described living as a fugitive across Europe, South America, and an unnamed island nation. According to Dutch extradition documents, the KyberSwap attack was allegedly executed from a hotel in The Hague where Medjedovic had checked in using a fake Slovak passport. Medjedovic was arrested in Belgrade, Serbia, approximately nine months after the Dutch warrant was issued. After 105 days in Serbian custody, he was released when the Belgrade Higher Court denied the Dutch extradition request, ruling that Dutch prosecutors had not sufficiently proven his identity as the perpetrator and that the alleged crimes carried too light a domestic sentence to warrant extradition. He subsequently resurfaced in Bosnia, and as of January 2025 was believed by the DOJ to be at large there. An Interpol Red Notice has been issued. Separately, Medjedovic has reportedly hired Washington D.C. lobbyists at a reported cost of $300,000 to pursue a pardon.","heading":"Fugitive Status and International Pursuit","sources":[{"url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147","name":"cbc.ca","type":"other","credibility":3},{"url":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/","name":"balkaninsight.com","type":"other","credibility":3},{"url":"https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/","name":"balkaninsight.com","type":"other","credibility":3},{"url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes","name":"justice.gov","type":"other","credibility":3}],"severity":"medium"},{"content":"In the immediate aftermath of the exploit, Kyber Network suspended all liquidity additions across KyberSwap Elastic pools and urged users to withdraw funds. Approximately $5.17 million was recovered from two front-running bot operators who responded to a 10% bug bounty offer, and an additional $706,000 in locked assets was recovered. On December 24, 2023, CEO Victor Tran announced a 50% workforce reduction across the company, citing the need to sustain operations after the financial losses. Kyber Network also paused KyberSwap Elastic liquidity initiatives and the KyberAI project, though the aggregator and limit order features remained operational. A Treasury Grant Program was announced in late December 2023 offering affected users either 60% of their losses in stablecoins over 3 months vesting, or 100% over 12 months vesting, with distributions beginning February 1, 2024. Total grant obligations approached $49 million, substantially exceeding the approximately $6 million recovered. By 2025, KyberSwap reported processing over $100 billion in cumulative trading volume using its DEX aggregator and launched new liquidity mechanisms such as FairFlow, though TVL in Elastic pools remained depressed.","heading":"Organizational Impact and Recovery Efforts","sources":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"blog.kyberswap.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/","name":"blog.kyberswap.com","type":"other","credibility":3},{"url":"https://crypto.news/kyberswap-laid-off-50-of-workforce-after-54m-elastic-exploit/","name":"crypto.news","type":"other","credibility":3}],"severity":"medium"},{"content":"Andean Medjedovic is also alleged to have executed the Indexed Finance exploit in October 2021, stealing approximately $16 million from that protocol using a mathematically similar technique involving price manipulation of automated market maker contracts. He has publicly acknowledged responsibility for that attack while previously denying involvement in the KyberSwap exploit. KyberSwap itself had undergone multiple security audits of its Elastic contracts prior to the November 2023 exploit; the specific tick-crossing arithmetic vulnerability was not identified in those audits. The exploit demonstrated that even extensively audited concentrated liquidity protocols may contain subtle edge-case vulnerabilities that emerge only under adversarially crafted conditions.","heading":"Prior Security Incidents","sources":[{"url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/3f9rJpDr4kzqZsM2VwgiSA-kyberswap-elastic","name":"certik.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-10","event":"Indexed Finance DeFi protocol exploited for approximately $16 million. Andean Medjedovic later publicly acknowledged responsibility.","source":"","date_original":"2021-10-01"},{"date":"2021-12","event":"Canadian court issues arrest warrant for Andean Medjedovic in connection with the Indexed Finance exploit. Medjedovic does not appear and becomes a fugitive.","source":"","date_original":"2021-12-01"},{"date":"2023-11-22","event":"KyberSwap Elastic pools exploited via tick-manipulation and liquidity double-counting attack. Approximately $48.8 million drained from 77 pools across 13 chains. TVL drops from ~$80M to ~$22M.","source":""},{"date":"2023-11-22","event":"Kyber Network issues emergency advisory urging all users to withdraw funds from KyberSwap Elastic.","source":""},{"date":"2023-11-23","event":"Attacker posts on-chain message: 'negotiations will start in a few hours when I am fully rested,' taunting victims and referencing Ontario, Canada.","source":""},{"date":"2023-11-30","event":"Attacker, styling themselves 'Kyber Director,' posts on-chain ransom letter demanding complete executive and governance control of Kyber Network in exchange for returning 50% of stolen funds. December 10 deadline set.","source":""},{"date":"2023-12","event":"Netherlands issues a European arrest warrant for Andean Medjedovic in connection with the KyberSwap exploit. Dutch extradition documents allege the attack was carried out from a hotel in The Hague using a fake Slovak passport.","source":"","date_original":"2023-12-01"},{"date":"2023-12-10","event":"Attacker's stated deadline for Kyber Network to comply with control demands passes without agreement.","source":""},{"date":"2023-12-20","event":"KyberSwap launches Treasury Grant Program offering affected users 60% immediate or 100% long-term stablecoin compensation for unrecovered losses.","source":""},{"date":"2023-12-24","event":"Kyber Network CEO Victor Tran announces 50% workforce reduction to sustain operations following the exploit.","source":""},{"date":"2024-01-19","event":"Treasury Grant Program UI opens for affected user registration and option selection.","source":""},{"date":"2024-02","event":"KyberSwap Treasury Grant vesting begins for eligible users.","source":"","date_original":"2024-02-01"},{"date":"2024-09","event":"Andean Medjedovic arrested in Belgrade, Serbia, approximately nine months after the Dutch arrest warrant was issued.","source":"","date_original":"2024-09-01"},{"date":"2025-01-17","event":"After 105 days in Serbian custody, Belgrade Higher Court denies Dutch extradition request. Medjedovic released and subsequently reported to be at large in Bosnia per DOJ filing.","source":""},{"date":"2025-02-03","event":"U.S. Department of Justice (EDNY) unseals federal indictment against Andean Medjedovic charging five counts including wire fraud, CFAA violations, Hobbs Act extortion, and money laundering conspiracy, covering $65 million across KyberSwap and Indexed Finance.","source":""},{"date":"2026-01-30","event":"Reports confirm Medjedovic has resurfaced in Bosnia after escaping Serbian custody. Interpol Red Notice remains active.","source":""},{"date":"2026-03-24","event":"Reports indicate Medjedovic has hired Washington D.C. lobbyists at a reported cost of $300,000 to pursue a presidential pardon.","source":""}],"sources_used":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"Post Mortem: KyberSwap Elastic Exploit November 2023 — KyberSwap Official Blog","type":"official","archive_url":"http://web.archive.org/web/20260412060634/https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","credibility":1,"archive_timestamp":"2026-04-12T06:06:34+00:00"},{"url":"https://www.coindesk.com/tech/2023/11/23/kyberswap-dex-hacked-for-48-million-attacker-teases-negotiations","name":"KyberSwap DEX Hacked for $48 Million, Attacker Teases Negotiations — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20251129190352/https://www.coindesk.com/tech/2023/11/23/kyberswap-dex-hacked-for-48-million-attacker-teases-negotiations","credibility":1,"archive_timestamp":"2025-11-29T19:03:52+00:00"},{"url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter","name":"KyberSwap Hacker Demands Company Control in Unhinged On-Chain Ransom Letter — Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260510025649/https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter","credibility":2,"archive_timestamp":"2026-05-10T02:56:49+00:00"},{"url":"https://www.theblock.co/post/265429/kyber-hacker-control-message","name":"KyberSwap hacker demands full control in bizarre on-chain message — The Block","type":"news_article","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes","name":"Canadian Man Charged in $65M Cryptocurrency Hacking Schemes — DOJ Office of Public Affairs","type":"regulatory","archive_url":"http://web.archive.org/web/20260712093555/https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes","credibility":1,"archive_timestamp":"2026-07-12T09:35:55+00:00"},{"url":"https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi","name":"Canadian National Charged With Stealing Approximately $65 Million — DOJ EDNY","type":"court_filing","archive_url":"http://web.archive.org/web/20260524220712/https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi","credibility":1,"archive_timestamp":"2026-05-24T22:07:12+00:00"},{"url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","name":"U.S. Prosecutors Charge Canadian Man With $65M Hacks of Indexed Finance, KyberSwap — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260725154919/https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","credibility":1,"archive_timestamp":"2026-07-25T15:49:19+00:00"},{"url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147","name":"Fake passports, $65M US and an Interpol Red Notice: Canadian crypto fugitive vanishes after arrest in Serbia — CBC News","type":"news_article","archive_url":"http://web.archive.org/web/20260206091129/https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147","credibility":1,"archive_timestamp":"2026-02-06T09:11:29+00:00"},{"url":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/","name":"Canadian Crypto Fugitive Slips Dragnet in Serbia, Surfaces in Bosnia — Balkan Insight","type":"news_article","archive_url":"http://web.archive.org/web/20260324202901/https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/","credibility":2,"archive_timestamp":"2026-03-24T20:29:01+00:00"},{"url":"https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/","name":"Fugitive Canadian Hacker, Released by Serbia, Seeks Pardon from Trump — Balkan Insight","type":"news_article","archive_url":"http://web.archive.org/web/20260514092206/https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/","credibility":2,"archive_timestamp":"2026-05-14T09:22:06+00:00"},{"url":"https://blocksec.com/blog/kyberswap-incident-masterful-exploitation-of-rounding-errors-with-exceedingly-subtle-calculations","name":"KyberSwap Incident: Masterful Exploitation of Rounding Errors — BlockSec Blog","type":"research","archive_url":"http://web.archive.org/web/20260416012046/https://blocksec.com/blog/kyberswap-incident-masterful-exploitation-of-rounding-errors-with-exceedingly-subtle-calculations","credibility":2,"archive_timestamp":"2026-04-16T01:20:46+00:00"},{"url":"https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3305d3a","name":"A Deep Dive Into the KyberSwap Hack — SlowMist (Medium)","type":"research","archive_url":"http://web.archive.org/web/20251117040514/https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3305d3a","credibility":2,"archive_timestamp":"2025-11-17T04:05:14+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","name":"Explained: The KyberSwap Hack November 2023 — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260525194207/https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","credibility":2,"archive_timestamp":"2026-05-25T19:42:07+00:00"},{"url":"https://www.certik.com/resources/blog/3f9rJpDr4kzqZsM2VwgiSA-kyberswap-elastic","name":"KyberSwap Elastic — CertiK Audit Resource","type":"research","archive_url":"https://web.archive.org/web/20260726135748/https://www.certik.com/blog/3f9rJpDr4kzqZsM2VwgiSA-kyberswap-elastic","credibility":2,"archive_timestamp":"2026-07-26T13:57:48+00:00"},{"url":"https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit","name":"Kyber Network Cuts 50% of Staff Following $48 Million Exploit — CoinTelegraph","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/","name":"KyberSwap Treasury Grant Program — KyberSwap Official Blog","type":"official","archive_url":"http://web.archive.org/web/20260606134350/https://blog.kyberswap.com/kyberswap-treasury-grant-program/","credibility":1,"archive_timestamp":"2026-06-06T13:43:50+00:00"},{"url":"https://www.bankinfosecurity.com/cryptohack-roundup-kyberswap-hacker-demands-control-a-23733","name":"CryptoHack Roundup: KyberSwap Hacker Demands Control — BankInfoSecurity","type":"news_article","archive_url":"https://web.archive.org/web/20260726043120/https://www.bankinfosecurity.com/cryptohack-roundup-kyberswap-hacker-demands-control-a-23733","credibility":2,"archive_timestamp":"2026-07-26T04:31:20+00:00"},{"url":"https://blog.kyberswap.com/kyberswap-2025-recap-a-year-of-momentum-at-scale/","name":"KyberSwap 2025 Recap — KyberSwap Official Blog","type":"official","archive_url":"http://web.archive.org/web/20260412051716/https://blog.kyberswap.com/kyberswap-2025-recap-a-year-of-momentum-at-scale/","credibility":1,"archive_timestamp":"2026-04-12T05:17:16+00:00"}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-30T18:25:24.860846+00:00","updated_at":"2026-08-29T01:33:38.89+00:00"}}