{"investigation":{"slug":"kyberswap","entity_name":"KyberSwap","trust_score":62,"severity_base":62,"score_modifier":0,"confidence":0.87,"status":"published","content_type":"investigation","summary":"KyberSwap is a multi-chain decentralized exchange aggregator and liquidity protocol operated by Kyber Network, offering the full-range KyberSwap Classic AMM and the concentrated-liquidity KyberSwap Elastic. On November 22, 2023, KyberSwap Elastic was exploited across 13 chains through a tick-manipulation and rounding-error flaw, with roughly $48.7-48.9 million taken by the primary exploiter and a further $6.6 million by front-running bots, despite prior audits. The alleged attacker, Canadian national Andean Medjedovic, demanded control of Kyber Network in exchange for returning half the funds, was indicted by the U.S. Department of Justice in February 2025, and remains a fugitive; Kyber compensated affected users through a Treasury Grant Program.","sections":[{"content":"KyberSwap is a decentralized exchange (DEX) aggregator and automated market maker (AMM) protocol developed by Kyber Network, a Singapore-based blockchain company founded in 2017 and co-founded by Loi Luu, Victor Tran and Yaron Velner. The platform operates across more than 17 blockchain networks and offers two distinct liquidity products: KyberSwap Classic, a traditional AMM providing liquidity across the full price range with a dynamic fee mechanism; and KyberSwap Elastic, a concentrated liquidity protocol launched in December 2021 that lets liquidity providers supply assets within custom price ranges, similar to Uniswap v3. Elastic also features automatic fee reinvestment through a dedicated reinvestment curve, which proved to be the vector for the November 2023 exploit. Before the exploit, KyberSwap Elastic had total value locked (TVL) of approximately $80 million. The native token KNC (Kyber Network Crystal) is used for governance through KyberDAO. By 2025 the platform reported over $100 billion in cumulative trading volume since inception.","heading":"Overview and Platform Background","sources":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"Post Mortem: KyberSwap Elastic Exploit November 2023 - KyberSwap Official Blog","type":"official","credibility":1},{"url":"https://blog.kyberswap.com/kyberswap-2025-recap-a-year-of-momentum-at-scale/","name":"KyberSwap 2025 Recap - KyberSwap Official Blog","type":"official","credibility":1},{"url":"https://docs.kyberswap.com/","name":"Introduction to KyberSwap - KyberSwap Docs","type":"official","credibility":1},{"url":"https://support.kyberswap.com/hc/en-us/articles/13766696328729-What-is-the-Difference-Between-KyberSwap-Classic-and-KyberSwap-Elastic","name":"What is the Difference Between KyberSwap Classic and KyberSwap Elastic? - KyberSwap Help Center","type":"official","credibility":1},{"url":"https://blog.kyberswap.com/announcing-our-new-kyberswap-protocol-kyberswap-elastic/","name":"Announcing Our New KyberSwap Protocol - KyberSwap Elastic - KyberSwap Blog","type":"official","credibility":1}],"severity":"low"},{"content":"On November 22, 2023, an attacker exploited a critical vulnerability in KyberSwap Elastic's concentrated liquidity contracts, draining 77 liquidity pools across 13 chains: Arbitrum (about $20 million), Optimism (about $15 million), Ethereum (about $7 million), BNB Chain, Avalanche, Polygon, Fantom, Base, Scroll, Linea, Polygon zkEVM, BitTorrent and Cronos. Reports differ on the amount taken by the primary exploiter: approximately $48.8 million according to one input page (citing the KyberSwap post-mortem, CoinDesk and Halborn), $48.7 million according to another, which also gives $48.9 million in its summary. An additional $6.6 million was extracted by front-running MEV bots that detected and mimicked the attack, for a combined total of approximately $55.2 million. The KyberSwap post-mortem, as cited by one input page, values total affected user assets, including liquidity positions and LP fees across 2,367 impacted addresses, at approximately $56.2 million. The primary attacker address identified is 0x50275E0B7261559cE1644014d4b78D4AA63BE836.\n\nReports also differ on the impact on TVL: one account gives a fall from approximately $80 million to $22.23 million (a drop of over 72%), while CoinDesk reported a fall from approximately $86 million to $7.17 million (roughly 90%).","heading":"November 2023 Elastic Exploit","sources":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"Post Mortem: KyberSwap Elastic Exploit November 2023 - KyberSwap Official Blog","type":"official","credibility":1},{"url":"https://www.coindesk.com/tech/2023/11/23/kyberswap-dex-hacked-for-48-million-attacker-teases-negotiations","name":"KyberSwap DEX Hacked for $48 Million, Attacker Teases Negotiations - CoinDesk","type":"news_article","credibility":1},{"url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","name":"Explained: The KyberSwap Hack November 2023 - Halborn","type":"research","credibility":2},{"url":"https://hacken.io/insights/kyberswap-hack-explained/","name":"KyberSwap's $47M Reentrancy Attack: A Deep Dive into the Exploit - Hacken","type":"research","credibility":2}],"severity":"critical"},{"content":"Security researchers described the attack as one of the most technically sophisticated DeFi exploits on record. The root cause was a precision error and arithmetic inconsistency in KyberSwap Elastic's computeSwapStep() function. A double rounding error allowed the computed result price to exceed the target price in edge cases: when a swap amount was crafted to fall just below the threshold needed to cross a tick boundary, updateLiquidityAndCrossTick was not triggered even though the tick state advanced. The pool's internal baseL (base liquidity) variable was therefore not decremented when the price moved back through the tick, so the protocol double-counted liquidity and believed far more was available than actually existed.\n\nThe attacker took a flash loan of approximately 10,000 wstETH (roughly $23 million), manipulated the pool price outside the active liquidity range, added and partially removed liquidity to reach a specific internal state, and executed a precisely calculated swap (an amount of 244,080,034,447,359,999,999 units) that triggered the rounding flaw; a reverse swap then extracted the inflated balance. BlockSec, Halborn and SlowMist independently described the flaw as 'slightly different arithmetic' between two functions that should have been consistent and classified it as a precision-loss or rounding-error exploit, not a reentrancy attack; Hacken's analysis is nonetheless titled as a 'reentrancy attack'. SlowMist, BlockSec, Hacken, Halborn and QuillAudits each published independent on-chain reconstructions corroborating the rounding-error mechanism described in Kyber's post-mortem.","heading":"Technical Root Cause: Tick Manipulation and Liquidity Double-Counting","sources":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"Post Mortem: KyberSwap Elastic Exploit November 2023 - KyberSwap Official Blog","type":"official","credibility":1},{"url":"https://blocksec.com/blog/kyberswap-incident-masterful-exploitation-of-rounding-errors-with-exceedingly-subtle-calculations","name":"KyberSwap Incident: Masterful Exploitation of Rounding Errors - BlockSec Blog","type":"research","credibility":2},{"url":"https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1","name":"Yet Another Tragedy of Precision Loss: An In-Depth Analysis of the KyberSwap Incident - BlockSec","type":"research","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","name":"Explained: The KyberSwap Hack November 2023 - Halborn","type":"research","credibility":2},{"url":"https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3305d3a","name":"A Deep Dive Into the KyberSwap Hack - SlowMist (Medium)","type":"research","credibility":2},{"url":"https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3805d3a","name":"A Deep Dive Into the KyberSwap Hack - SlowMist (Medium)","type":"research","credibility":2},{"url":"https://hacken.io/insights/kyberswap-hack-explained/","name":"KyberSwap's $47M Reentrancy Attack: A Deep Dive into the Exploit - Hacken","type":"research","credibility":2}],"severity":"high"},{"content":"KyberSwap Elastic had undergone multiple security reviews before the exploit, none of which identified the tick-crossing arithmetic flaw. ChainSecurity audited the protocol after its December 2021 launch and again after security enhancements deployed in May 2023, when Kyber hardened the contracts following an earlier vulnerability disclosure; all findings from the May 2023 audit were resolved except one accepted low-severity issue (DOMAIN_SEPARATOR not being recomputed if chainId changes). An open Sherlock audit contest with 207 participants completed in September 2023, about two months before the exploit, without identifying the vulnerability. CertiK and other auditing firms had also reviewed the Elastic code. The exploit shows that even extensively audited concentrated liquidity protocols can contain subtle edge-case vulnerabilities that surface only under adversarially crafted conditions.\n\nKyberSwap also suffered a separate frontend exploit in September 2022, in which a malicious script injected via a compromised third-party dependency redirected user approvals; smart contract funds were not affected.","heading":"Audit History and Prior Security Incidents","sources":[{"url":"https://docs.kyberswap.com/reference/legacy/audits","name":"Audits - KyberSwap Docs","type":"official","credibility":1},{"url":"https://www.chainsecurity.com/security-audit/kyberswap-elastic","name":"KyberSwap Elastic - ChainSecurity Smart Contract Audit","type":"research","credibility":2},{"url":"https://github.com/sherlock-audit/2023-07-kyber-swap","name":"Sherlock Audit Contest - kyber-swap (July 2023)","type":"research","credibility":2},{"url":"https://www.certik.com/resources/blog/3f9rJpDr4kzqZsM2VwgiSA-kyberswap-elastic","name":"KyberSwap Elastic - CertiK Audit Resource","type":"research","credibility":2},{"url":"https://blog.kyberswap.com/post-mortem-past-kyberswap-frontend-exploit-sept-2022/","name":"Post Mortem: Past KyberSwap Frontend Exploit (Sept 2022) - KyberSwap Blog","type":"official","credibility":1},{"url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","name":"Explained: The KyberSwap Hack November 2023 - Halborn","type":"research","credibility":2}],"severity":"high"},{"content":"Shortly after the exploit, the attacker posted on-chain messages taunting the Kyber Network team, saying 'negotiations will start in a few hours when I am fully rested' and asking 'how is Ontario this time of year.' On November 30, 2023, the attacker, signing as 'Kyber Director', published an on-chain ransom letter via an Ethereum transaction offering to return 50% of the stolen assets in exchange for: complete executive control of Kyber Network; full temporary authority over the KyberDAO governance mechanism; access to all internal documents covering structure, revenue, expenses, salaries, assets, liabilities and investors; and forfeiture of all company assets, including tokens, equity, intellectual property and social media accounts. In return, the attacker offered to lead the company, buy out current executives at 'fair valuation', double salaries for non-executive employees who stayed and give 12-month severance to those who left. The attacker framed the ultimatum as a 'treaty' with a December 10, 2023 deadline and warned that any government contact would void the arrangement. Kyber Network did not comply, and no formal acceptance was reported. In its February 2025 indictment, the DOJ characterized the settlement proposal as a 'sham' and charged it as attempted Hobbs Act extortion.","heading":"Attacker Extortion Demands","sources":[{"url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter","name":"KyberSwap Hacker Demands Company Control in Unhinged On-Chain Ransom Letter - Decrypt","type":"news_article","credibility":2},{"url":"https://www.bankinfosecurity.com/cryptohack-roundup-kyberswap-hacker-demands-control-a-23733","name":"CryptoHack Roundup: KyberSwap Hacker Demands Control - BankInfoSecurity","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/265429/kyber-hacker-control-message","name":"KyberSwap hacker demands full control in bizarre on-chain message - The Block","type":"news_article","credibility":1},{"url":"https://cointelegraph.com/news/kyberswap-hacker-demands-complete-control-over-kyber-company","name":"KyberSwap hacker demands complete control over Kyber company - CoinTelegraph","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/tech/2023/11/23/kyberswap-dex-hacked-for-48-million-attacker-teases-negotiations","name":"KyberSwap DEX Hacked for $48 Million, Attacker Teases Negotiations - CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","name":"U.S. Prosecutors Charge Canadian Man With $65M Hacks of Indexed Finance, KyberSwap - CoinDesk","type":"news_article","credibility":1},{"url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes","name":"Canadian Man Charged in $65M Cryptocurrency Hacking Schemes - DOJ Office of Public Affairs","type":"regulatory","credibility":1}],"severity":"high"},{"content":"On February 3, 2025, the U.S. Attorney's Office for the Eastern District of New York unsealed a five-count indictment against Andean 'Andy' Medjedovic, a 22-year-old Canadian national from Waterloo, Ontario, charging wire fraud, unauthorized damage to a protected computer (Computer Fraud and Abuse Act), attempted Hobbs Act extortion, money laundering conspiracy and money laundering. The indictment alleges he stole approximately $65 million from two DeFi protocols: about $16 million from Indexed Finance in 2021 and about $48.8 million from KyberSwap in 2023. According to the indictment, he borrowed hundreds of millions of dollars in digital tokens to make deceptive trades that caused the protocols' smart contracts to miscalculate key variables, letting him withdraw investor funds at artificial prices, and then allegedly laundered the proceeds through swaps, cross-chain bridge transfers and cryptocurrency mixers. Prosecutors allege he spent months planning the KyberSwap attack, with notes including the phrase 'Find time to Strike.' The combined maximum penalty is 90 years in prison. The investigation was conducted jointly by the FBI, IRS Criminal Investigation and Homeland Security Investigations.\n\nMedjedovic is also alleged to have carried out the October 2021 Indexed Finance exploit using a mathematically similar AMM price-manipulation technique. He has reportedly acknowledged responsibility for that attack, which he allegedly carried out as a teenager, while previously denying involvement in the KyberSwap exploit. The charges remain allegations; he has not been tried.","heading":"DOJ Indictment of Alleged Attacker Andean Medjedovic","sources":[{"url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes","name":"Canadian Man Charged in $65M Cryptocurrency Hacking Schemes - DOJ Office of Public Affairs","type":"regulatory","credibility":1},{"url":"https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi","name":"Canadian National Charged With Stealing Approximately $65 Million - DOJ EDNY","type":"court_filing","credibility":1},{"url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","name":"U.S. Prosecutors Charge Canadian Man With $65M Hacks of Indexed Finance, KyberSwap - CoinDesk","type":"news_article","credibility":1},{"url":"https://hackread.com/canadian-charged-kyberswap-indexed-finance-defi-hack/","name":"hackread.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/andean-medjedovic-kyberswap-alleged-hacker","name":"Who is Andean Medjedovic, the alleged $48M KyberSwap hacker? - CoinTelegraph","type":"news_article","credibility":2}],"severity":"high"},{"content":"Medjedovic has been at large since a Canadian court issued an arrest warrant in December 2021 over the Indexed Finance exploit. He has publicly described living as a fugitive across Europe, South America and an unnamed island nation. The Netherlands issued a European arrest warrant for him in December 2023; according to Dutch extradition documents, the KyberSwap attack was allegedly executed from a hotel in The Hague where he had checked in using a fake Slovak passport. He was arrested in Belgrade, Serbia, in September 2024, about nine months after the Dutch warrant. After 105 days in Serbian custody he was released when the Higher Court of Belgrade denied the Dutch extradition request, ruling that Dutch prosecutors had not sufficiently proven his identity as the perpetrator and that the alleged crimes carried too light a domestic sentence to justify extradition. The input pages date the release differently: November 2024 on one, January 17, 2025 on the other. He later resurfaced in Bosnia, and an Interpol Red Notice has been issued. The survivor page stated that 'as of January 2025' the DOJ believed he was at large in Bosnia, while the other page and Balkan Insight place this in early 2026. Reports from March 2026 say he hired a Washington, D.C. lobbying firm, reportedly for about $300,000, to seek a presidential pardon from the Trump administration.","heading":"Fugitive Status and International Pursuit","sources":[{"url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147","name":"Fake passports, $65M US and an Interpol Red Notice: Canadian crypto fugitive vanishes after arrest in Serbia - CBC News","type":"news_article","credibility":1},{"url":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/","name":"Canadian Crypto Fugitive Slips Dragnet in Serbia, Surfaces in Bosnia - Balkan Insight","type":"news_article","credibility":2},{"url":"https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/","name":"Fugitive Canadian Hacker, Released by Serbia, Seeks Pardon from Trump - Balkan Insight","type":"news_article","credibility":2},{"url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes","name":"Canadian Man Charged in $65M Cryptocurrency Hacking Schemes - DOJ Office of Public Affairs","type":"regulatory","credibility":1}],"severity":"medium"},{"content":"Blockchain investigator ZachXBT traced portions of the stolen funds, identifying approximately $40,000 moved to two specific wallet addresses immediately after the attack, and continued monitoring the attacker's wallet activity into 2026. In January 2026, reporting indicated that a wallet cluster associated with the broader investigation held 744,213 KNC tokens worth approximately $158,000, although the precise link between these holdings and Medjedovic's wallets has not been independently verified. The Nominis on-chain intelligence platform separately published analysis linking the primary exploiter's wallet activity and behavioural patterns.","heading":"On-Chain Tracing of Stolen Funds","sources":[{"url":"https://www.nominis.io/insights/kyberswap-hacker-uncovered","name":"KyberSwap Hacker Uncovered: Attack Analysis - Nominis Insights","type":"on_chain","credibility":2},{"url":"https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3805d3a","name":"A Deep Dive Into the KyberSwap Hack - SlowMist (Medium)","type":"research","credibility":2},{"url":"https://blocksec.com/blog/top-ten-awesome-security-incidents-in-2023","name":"Top Ten Security Incidents in 2023 - BlockSec","type":"research","credibility":2}],"severity":"medium"},{"content":"KyberSwap suspended liquidity additions across all chains within minutes of detecting the exploit on November 22, 2023, and urged users to withdraw funds from Elastic pools. Owners of two MEV front-running bots returned approximately $5.17 million of the $6.6 million they had extracted in response to a 10% bug bounty offer, and a further $706,000 in locked assets was recovered. Kyber also partnered with Arkham Intelligence on a bounty program to help identify the primary exploiter.\n\nKyber Network announced a Treasury Grant Program to compensate the 2,367 affected liquidity providers. Eligible users could choose 60% of the affected assets' reference value, vested over three months in USD stablecoins; 100%, vested over twelve months; or opting out. The input pages date the announcement differently: December 1, 2023 on one, late December 2023 (December 20 in its timeline) on the other. The Treasury Grant UI opened on January 19, 2024, and vesting began on February 1, 2024. Total grant obligations approached $49 million, far more than the approximately $6 million recovered.\n\nKyber Network cut its workforce by about 50% and paused the KyberAI project and Elastic liquidity initiatives, while the aggregator and limit-order features remained operational. The survivor page dates CEO Victor Tran's announcement of the cut to December 24, 2023, while the other page places it in 2024. The Elastic protocol was later relaunched with additional security measures and a KyberDAO-administered security fund. By 2025, KyberSwap reported over $100 billion in cumulative aggregator trading volume and had launched new liquidity mechanisms such as FairFlow, though Elastic pool TVL remained depressed.","heading":"Team Response, User Compensation and Organizational Impact","sources":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"Post Mortem: KyberSwap Elastic Exploit November 2023 - KyberSwap Official Blog","type":"official","credibility":1},{"url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/","name":"KyberSwap Treasury Grant Program - KyberSwap Official Blog","type":"official","credibility":1},{"url":"https://blog.kyberswap.com/kyberswap-elastic-exploit-treasury-grant-program-registration/","name":"Treasury Grant Program Registration for Affected Users - KyberSwap Blog","type":"official","credibility":1},{"url":"https://cointelegraph.com/news/kyberswap-announces-treasury-grants-for-hack-victims","name":"KyberSwap announces treasury grants for hack victims - CoinTelegraph","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit","name":"Kyber Network Cuts 50% of Staff Following $48 Million Exploit - CoinTelegraph","type":"news_article","credibility":2},{"url":"https://crypto.news/kyberswap-laid-off-50-of-workforce-after-54m-elastic-exploit/","name":"KyberSwap laid off 50% of workforce after $54m Elastic exploit - crypto.news","type":"news_article","credibility":2},{"url":"https://beincrypto.com/kyberswap-resumes-elastic-protocol-backed-by-kyberdao-security-fund/","name":"KyberSwap Resumes Elastic Protocol, Backed By KyberDAO Security Fund - BeInCrypto","type":"news_article","credibility":2},{"url":"https://blog.kyberswap.com/kyberswap-2025-recap-a-year-of-momentum-at-scale/","name":"KyberSwap 2025 Recap - KyberSwap Official Blog","type":"official","credibility":1}],"severity":"medium"}],"timeline":[{"date":"2021-10","event":"Indexed Finance exploited for approximately $16 million; Andean Medjedovic later reportedly acknowledged responsibility.","source":"CoinDesk","source_url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap"},{"date":"2021-12","event":"KyberSwap Elastic (concentrated liquidity protocol) launched.","source":"KyberSwap Blog","source_url":"https://blog.kyberswap.com/announcing-our-new-kyberswap-protocol-kyberswap-elastic/"},{"date":"2021-12","event":"Canadian court issues an arrest warrant for Andean Medjedovic over the Indexed Finance exploit; he becomes a fugitive.","source":"CBC News","source_url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"date":"2022-09","event":"KyberSwap frontend exploit: a malicious script injected via a compromised third-party dependency redirects user approvals; no smart contract funds drained.","source":"KyberSwap Blog","source_url":"https://blog.kyberswap.com/post-mortem-past-kyberswap-frontend-exploit-sept-2022/"},{"date":"2023-05","event":"KyberSwap Elastic contracts redeployed after hardening; ChainSecurity's final audit finds all issues resolved except one accepted low-severity item.","source":"KyberSwap Docs","source_url":"https://docs.kyberswap.com/reference/legacy/audits"},{"date":"2023-09","event":"Sherlock community audit contest with 207 participants concludes without identifying the tick-rounding vulnerability.","source":"Sherlock GitHub","source_url":"https://github.com/sherlock-audit/2023-07-kyber-swap"},{"date":"2023-11-22","event":"KyberSwap Elastic exploited across 13 chains; about $48.7-48.8 million taken by the primary exploiter and $6.6 million by front-running bots. KyberSwap suspends liquidity additions and urges users to withdraw.","source":"KyberSwap Blog Post-Mortem","source_url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","date_evidence":"Input page text: 'On November 22, 2023, an attacker exploited a critical vulnerability in KyberSwap Elastic's concentrated liquidity smart contracts'."},{"date":"2023-11-23","event":"CoinDesk reports the exploit and the attacker's on-chain message that 'negotiations will start in a few hours when I am fully rested'; CoinDesk reports TVL falling from about $86 million to $7.17 million.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/11/23/kyberswap-dex-hacked-for-48-million-attacker-teases-negotiations","date_evidence":"Publication date in the CoinDesk URL path (/2023/11/23/), whose headline reports the attacker teasing negotiations."},{"date":"2023-11-30","event":"Attacker, signing as 'Kyber Director', posts an on-chain ransom letter demanding executive and governance control of Kyber Network in exchange for returning 50% of the funds, with a December 10 deadline.","source":"Decrypt","source_url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter","date_evidence":"Input page text: 'On November 30, 2023, the attacker - signing as 'Kyber Director' - published an on-chain message'."},{"date":"2023-12","event":"Netherlands issues a European arrest warrant for Medjedovic; Dutch extradition documents allege the attack was carried out from a hotel in The Hague using a fake Slovak passport.","source":"CBC News","source_url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"date":"2023-12","event":"Survivor-page dating: KyberSwap launches the Treasury Grant Program (60% short-vesting or 100% long-vesting stablecoin compensation) in late December (given as December 20).","source":"KyberSwap Blog","source_url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/"},{"date":"2023-12-01","event":"Alternative dating: Kyber Network announces the Treasury Grant Program for affected users.","source":"KyberSwap Blog","source_url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/","date_evidence":"Input page text: 'On December 1, 2023, Kyber Network announced a Treasury Grant Program to compensate the 2,367 affected liquidity providers.'"},{"date":"2023-12-10","event":"The attacker's deadline passes with no agreement from Kyber Network.","source":"Decrypt","source_url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter","date_evidence":"Input page text: 'a deadline of December 10, 2023, after which the offer would lapse'."},{"date":"2023-12-24","event":"Kyber Network CEO Victor Tran announces a 50% workforce reduction (another input page dates the layoffs to 2024).","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit","date_evidence":"Input page text: 'On December 24, 2023, CEO Victor Tran announced a 50% workforce reduction'."},{"date":"2024-01-19","event":"Treasury Grant Program UI opens for registration; MEV bot operators return about $5.17 million of front-run assets.","source":"KyberSwap Blog","source_url":"https://blog.kyberswap.com/kyberswap-elastic-exploit-treasury-grant-program-registration/","date_evidence":"Input page text: 'The Treasury Grant UI launched on January 19, 2024'."},{"date":"2024-02","event":"Treasury Grant vesting begins for eligible users.","source":"KyberSwap Blog","source_url":"https://blog.kyberswap.com/kyberswap-elastic-exploit-treasury-grant-program-registration/"},{"date":"2024-09","event":"Andean Medjedovic arrested in Belgrade, Serbia, about nine months after the Dutch warrant.","source":"CBC News","source_url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"date":"2024-11","event":"According to one input page, Medjedovic is released after 105 days when the Higher Court of Belgrade denies the Dutch extradition request.","source":"CBC News","source_url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"date":"2025-01","event":"Alternative dating (survivor page, given as January 17, 2025): after 105 days in Serbian custody, the Belgrade Higher Court denies extradition and Medjedovic is released.","source":"CBC News","source_url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"date":"2025-02-03","event":"DOJ (EDNY) unseals a five-count indictment against Medjedovic (wire fraud, CFAA damage, attempted Hobbs Act extortion, money laundering conspiracy, money laundering) covering about $65 million across KyberSwap and Indexed Finance.","source":"U.S. Department of Justice","source_url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes","date_evidence":"Input page text: 'On February 3, 2025, the U.S. Attorney's Office for the Eastern District of New York (EDNY) unsealed a federal indictment'."},{"date":"2026-01-30","event":"Reports say Medjedovic has surfaced in Bosnia after slipping Serbian authorities; the DOJ says he remains at large and an Interpol Red Notice is active.","source":"Balkan Insight","source_url":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/","date_evidence":"Publication date in the Balkan Insight URL path (/2026/01/30/)."},{"date":"2026-03-24","event":"Reports say Medjedovic has hired a Washington, D.C. lobbying firm for about $300,000 to seek a presidential pardon.","source":"Balkan Insight","source_url":"https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/","date_evidence":"Publication date in the Balkan Insight URL path (/2026/03/24/)."}],"sources_used":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"Post Mortem: KyberSwap Elastic Exploit November 2023 - KyberSwap Official Blog","type":"official","archive_url":"http://web.archive.org/web/20260412060634/https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","credibility":1,"archive_timestamp":"2026-04-12T06:06:34+00:00"},{"url":"https://www.coindesk.com/tech/2023/11/23/kyberswap-dex-hacked-for-48-million-attacker-teases-negotiations","name":"KyberSwap DEX Hacked for $48 Million, Attacker Teases Negotiations - CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20251129190352/https://www.coindesk.com/tech/2023/11/23/kyberswap-dex-hacked-for-48-million-attacker-teases-negotiations","credibility":1,"archive_timestamp":"2025-11-29T19:03:52+00:00"},{"url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter","name":"KyberSwap Hacker Demands Company Control in Unhinged On-Chain Ransom Letter - Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260510025649/https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter","credibility":2,"archive_timestamp":"2026-05-10T02:56:49+00:00"},{"url":"https://www.theblock.co/post/265429/kyber-hacker-control-message","name":"KyberSwap hacker demands full control in bizarre on-chain message - The Block","type":"news_article","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes","name":"Canadian Man Charged in $65M Cryptocurrency Hacking Schemes - DOJ Office of Public Affairs","type":"regulatory","archive_url":"http://web.archive.org/web/20260712093555/https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes","credibility":1,"archive_timestamp":"2026-07-12T09:35:55+00:00"},{"url":"https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi","name":"Canadian National Charged With Stealing Approximately $65 Million - DOJ EDNY","type":"court_filing","archive_url":"http://web.archive.org/web/20260524220712/https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi","credibility":1,"archive_timestamp":"2026-05-24T22:07:12+00:00"},{"url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","name":"U.S. Prosecutors Charge Canadian Man With $65M Hacks of Indexed Finance, KyberSwap - CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260725154919/https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","credibility":1,"archive_timestamp":"2026-07-25T15:49:19+00:00"},{"url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147","name":"Fake passports, $65M US and an Interpol Red Notice: Canadian crypto fugitive vanishes after arrest in Serbia - CBC News","type":"news_article","archive_url":"http://web.archive.org/web/20260206091129/https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147","credibility":1,"archive_timestamp":"2026-02-06T09:11:29+00:00"},{"url":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/","name":"Canadian Crypto Fugitive Slips Dragnet in Serbia, Surfaces in Bosnia - Balkan Insight","type":"news_article","archive_url":"http://web.archive.org/web/20260324202901/https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/","credibility":2,"archive_timestamp":"2026-03-24T20:29:01+00:00"},{"url":"https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/","name":"Fugitive Canadian Hacker, Released by Serbia, Seeks Pardon from Trump - Balkan Insight","type":"news_article","archive_url":"http://web.archive.org/web/20260514092206/https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/","credibility":2,"archive_timestamp":"2026-05-14T09:22:06+00:00"},{"url":"https://blocksec.com/blog/kyberswap-incident-masterful-exploitation-of-rounding-errors-with-exceedingly-subtle-calculations","name":"KyberSwap Incident: Masterful Exploitation of Rounding Errors - BlockSec Blog","type":"research","archive_url":"http://web.archive.org/web/20260416012046/https://blocksec.com/blog/kyberswap-incident-masterful-exploitation-of-rounding-errors-with-exceedingly-subtle-calculations","credibility":2,"archive_timestamp":"2026-04-16T01:20:46+00:00"},{"url":"https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3305d3a","name":"A Deep Dive Into the KyberSwap Hack - SlowMist (Medium)","type":"research","archive_url":"http://web.archive.org/web/20251117040514/https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3305d3a","credibility":2,"archive_timestamp":"2025-11-17T04:05:14+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","name":"Explained: The KyberSwap Hack November 2023 - Halborn","type":"research","archive_url":"http://web.archive.org/web/20260525194207/https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","credibility":2,"archive_timestamp":"2026-05-25T19:42:07+00:00"},{"url":"https://www.certik.com/resources/blog/3f9rJpDr4kzqZsM2VwgiSA-kyberswap-elastic","name":"KyberSwap Elastic - CertiK Audit Resource","type":"research","archive_url":"https://web.archive.org/web/20260726135748/https://www.certik.com/blog/3f9rJpDr4kzqZsM2VwgiSA-kyberswap-elastic","credibility":2,"archive_timestamp":"2026-07-26T13:57:48+00:00"},{"url":"https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit","name":"Kyber Network Cuts 50% of Staff Following $48 Million Exploit - CoinTelegraph","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/","name":"KyberSwap Treasury Grant Program - KyberSwap Official Blog","type":"official","archive_url":"http://web.archive.org/web/20260606134350/https://blog.kyberswap.com/kyberswap-treasury-grant-program/","credibility":1,"archive_timestamp":"2026-06-06T13:43:50+00:00"},{"url":"https://www.bankinfosecurity.com/cryptohack-roundup-kyberswap-hacker-demands-control-a-23733","name":"CryptoHack Roundup: KyberSwap Hacker Demands Control - BankInfoSecurity","type":"news_article","archive_url":"https://web.archive.org/web/20260726043120/https://www.bankinfosecurity.com/cryptohack-roundup-kyberswap-hacker-demands-control-a-23733","credibility":2,"archive_timestamp":"2026-07-26T04:31:20+00:00"},{"url":"https://blog.kyberswap.com/kyberswap-2025-recap-a-year-of-momentum-at-scale/","name":"KyberSwap 2025 Recap - KyberSwap Official Blog","type":"official","archive_url":"http://web.archive.org/web/20260412051716/https://blog.kyberswap.com/kyberswap-2025-recap-a-year-of-momentum-at-scale/","credibility":1,"archive_timestamp":"2026-04-12T05:17:16+00:00"},{"url":"https://hackread.com/canadian-charged-kyberswap-indexed-finance-defi-hack/","name":"hackread.com","type":"other","archive_url":"https://web.archive.org/web/20261002174234/https://hackread.com/canadian-charged-kyberswap-indexed-finance-defi-hack/","credibility":3,"archive_timestamp":"2026-10-02T17:42:34+00:00"},{"url":"https://hacken.io/insights/kyberswap-hack-explained/","name":"KyberSwap's $47M Reentrancy Attack: A Deep Dive into the Exploit - Hacken","type":"research","archive_url":"http://web.archive.org/web/20260420193138/https://hacken.io/insights/kyberswap-hack-explained/","credibility":2,"archive_timestamp":"2026-04-20T19:31:38+00:00"},{"url":"https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1","name":"Yet Another Tragedy of Precision Loss: An In-Depth Analysis of the KyberSwap Incident - BlockSec","type":"research","archive_url":"http://web.archive.org/web/20260606075636/https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1","credibility":2,"archive_timestamp":"2026-06-06T07:56:36+00:00"},{"url":"https://blog.kyberswap.com/kyberswap-elastic-exploit-treasury-grant-program-registration/","name":"Treasury Grant Program Registration for Affected Users - KyberSwap Blog","type":"official","archive_url":"http://web.archive.org/web/20260209053518/https://blog.kyberswap.com/kyberswap-elastic-exploit-treasury-grant-program-registration/","credibility":1,"archive_timestamp":"2026-02-09T05:35:18+00:00"},{"url":"https://crypto.news/kyberswap-laid-off-50-of-workforce-after-54m-elastic-exploit/","name":"KyberSwap laid off 50% of workforce after $54m Elastic exploit - crypto.news","type":"news_article","archive_url":"http://web.archive.org/web/20251015054722/https://crypto.news/kyberswap-laid-off-50-of-workforce-after-54m-elastic-exploit/","credibility":2,"archive_timestamp":"2025-10-15T05:47:22+00:00"},{"url":"https://www.chainsecurity.com/security-audit/kyberswap-elastic","name":"KyberSwap Elastic - ChainSecurity Smart Contract Audit","type":"research","archive_url":"http://web.archive.org/web/20260710090557/https://www.chainsecurity.com/security-audit/kyberswap-elastic","credibility":2,"archive_timestamp":"2026-07-10T09:05:57+00:00"},{"url":"https://github.com/sherlock-audit/2023-07-kyber-swap","name":"Sherlock Audit Contest - kyber-swap (July 2023)","type":"research","archive_url":null,"credibility":2,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.nominis.io/insights/kyberswap-hacker-uncovered","name":"KyberSwap Hacker Uncovered: Attack Analysis - Nominis Insights","type":"on_chain","archive_url":"http://web.archive.org/web/20260516075636/https://www.nominis.io/insights/kyberswap-hacker-uncovered","credibility":2,"archive_timestamp":"2026-05-16T07:56:36+00:00"},{"url":"https://beincrypto.com/kyberswap-resumes-elastic-protocol-backed-by-kyberdao-security-fund/","name":"KyberSwap Resumes Elastic Protocol, Backed By KyberDAO Security Fund - BeInCrypto","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://docs.kyberswap.com/reference/legacy/audits","name":"Audits - KyberSwap Docs","type":"official","archive_url":"http://web.archive.org/web/20260414084238/https://docs.kyberswap.com/reference/legacy/audits","credibility":1,"archive_timestamp":"2026-04-14T08:42:38+00:00"},{"url":"https://docs.kyberswap.com/","name":"Introduction to KyberSwap - KyberSwap Docs","type":"official","archive_url":"http://web.archive.org/web/20260718143704/https://docs.kyberswap.com/","credibility":1,"archive_timestamp":"2026-07-18T14:37:04+00:00"},{"url":"https://support.kyberswap.com/hc/en-us/articles/13766696328729-What-is-the-Difference-Between-KyberSwap-Classic-and-KyberSwap-Elastic","name":"What is the Difference Between KyberSwap Classic and KyberSwap Elastic? - KyberSwap Help Center","type":"official","archive_url":"http://web.archive.org/web/20251007152612/https://support.kyberswap.com/hc/en-us/articles/13766696328729-What-is-the-Difference-Between-KyberSwap-Classic-and-KyberSwap-Elastic","credibility":1,"archive_timestamp":"2025-10-07T15:26:12+00:00"},{"url":"https://blog.kyberswap.com/announcing-our-new-kyberswap-protocol-kyberswap-elastic/","name":"Announcing Our New KyberSwap Protocol - KyberSwap Elastic - KyberSwap Blog","type":"official","archive_url":"https://web.archive.org/web/20261002081726/https://blog.kyberswap.com/announcing-our-new-kyberswap-protocol-kyberswap-elastic-2/","credibility":1,"archive_timestamp":"2026-10-02T08:17:26+00:00"},{"url":"https://cointelegraph.com/news/kyberswap-hacker-demands-complete-control-over-kyber-company","name":"KyberSwap hacker demands complete control over Kyber company - CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260829182554/https://cointelegraph.com/news/kyberswap-hacker-demands-complete-control-over-kyber-company","credibility":2,"archive_timestamp":"2026-08-29T18:25:54+00:00"},{"url":"https://cointelegraph.com/news/andean-medjedovic-kyberswap-alleged-hacker","name":"Who is Andean Medjedovic, the alleged $48M KyberSwap hacker? - CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20251213110912/https://cointelegraph.com/news/andean-medjedovic-kyberswap-alleged-hacker","credibility":2,"archive_timestamp":"2025-12-13T11:09:12+00:00"},{"url":"https://blog.kyberswap.com/post-mortem-past-kyberswap-frontend-exploit-sept-2022/","name":"Post Mortem: Past KyberSwap Frontend Exploit (Sept 2022) - KyberSwap Blog","type":"official","archive_url":"http://web.archive.org/web/20260910015107/https://blog.kyberswap.com/post-mortem-past-kyberswap-frontend-exploit-sept-2022/","credibility":1,"archive_timestamp":"2026-09-10T01:51:07+00:00"},{"url":"https://cointelegraph.com/news/kyberswap-announces-treasury-grants-for-hack-victims","name":"KyberSwap announces treasury grants for hack victims - CoinTelegraph","type":"news_article","archive_url":"https://web.archive.org/web/20261002130014/https://cointelegraph.com/news/kyberswap-announces-treasury-grants-for-hack-victims","credibility":2,"archive_timestamp":"2026-10-02T13:00:14+00:00"},{"url":"https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3805d3a","name":"A Deep Dive Into the KyberSwap Hack - SlowMist (Medium)","type":"research","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blocksec.com/blog/top-ten-awesome-security-incidents-in-2023","name":"Top Ten Security Incidents in 2023 - BlockSec","type":"research","archive_url":"http://web.archive.org/web/20260316122103/https://blocksec.com/blog/top-ten-awesome-security-incidents-in-2023","credibility":2,"archive_timestamp":"2026-03-16T12:21:03+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-merge-writer","created_at":"2026-05-30T18:25:24.860846+00:00","updated_at":"2026-10-10T18:45:27.655+00:00"},"source_quality":{"total":37,"tier1":2,"tier2":9,"tier3":0,"unrated":26},"follower_count":null,"content_updated_at":"2026-10-10T18:45:28.013Z","last_fact_checked_at":"2026-06-14T23:16:05.846Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}