{"investigation":{"slug":"kyberswap-elastic","entity_name":"KyberSwap Elastic","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"KyberSwap Elastic is the concentrated liquidity automated market maker (AMM) component of Kyber Network, a decentralized exchange protocol deployed across more than a dozen EVM-compatible blockchains. On November 22–23, 2023, it suffered the largest DeFi exploit of that year — approximately $48–56 million drained via a precision rounding bug in its tick-crossing swap logic — after which the alleged attacker issued an on-chain ultimatum demanding full executive control of the company. Canadian national Andean Medjedovic was indicted by U.S. prosecutors in February 2025 on charges including wire fraud, computer hacking, and extortion; he remains a fugitive as of mid-2026.","sections":[{"content":"KyberSwap Elastic is the second-generation liquidity protocol of Kyber Network, launched in December 2021. It implements a tick-based concentrated liquidity model similar to Uniswap v3, allowing liquidity providers to allocate capital within specific price ranges for capital efficiency. The protocol was deployed across Ethereum, Arbitrum, Optimism, Polygon, Base, Avalanche, BSC, Fantom, Scroll, Linea, Polygon zkEVM, BitTorrent, and Cronos. Prior to the November 2023 exploit, KyberSwap Elastic held approximately $71–86 million in total value locked (TVL). ChainSecurity conducted security audits of the Elastic contracts, including an audit of hardened contracts deployed in May 2023 following a vulnerability disclosure. The rounding error that enabled the November 2023 exploit was not identified during those audits.","heading":"Background","sources":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"","type":"other","credibility":3},{"url":"https://www.chainsecurity.com/security-audit/kyberswap-elastic","name":"","type":"other","credibility":3},{"url":"https://docs.kyberswap.com/reference/legacy/audits","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 22–23, 2023, an attacker drained approximately $48–56 million from KyberSwap Elastic liquidity pools across multiple chains. Independent security researcher Spreek detected the attack, and KyberNetwork confirmed it within roughly one hour. Losses by chain were reported as follows: over $20 million on Arbitrum, $15 million on Optimism, $7.5 million on Ethereum, $3 million on Polygon, $2 million on Base, and $23,000 on Avalanche. KyberSwap's own post-mortem later cited $55.2 million extracted in total with approximately 2,367 liquidity providers affected.\n\nThe root cause was a precision rounding error in the SwapMath contract's estimateIncrementalLiquidity function within the tick-based swap mechanism. Specifically, when a swap amount was insufficient to cross a tick boundary — a condition written as swapAmount = amountSwapToCrossTick – 1 — the computeSwapStep() function incorrectly computed the next price as slightly above the target price. This caused the pool to calculate that a tick had not been crossed, leaving liquidity in an inconsistent state: the liquidity was never removed, but the price moved as though it had been. When the attacker subsequently moved back into the liquidity range in a second swap, the pool double-counted the original liquidity — effectively creating a 'double liquidity' or 'infinite money glitch.' BlockSec researchers described this as 'a masterful exploitation of rounding errors with exceedingly subtle calculations.' The check failed by less than 0.00000000001%.\n\nThe attacker used flash loans to move pool prices into regions with no existing liquidity, executed the precision swap to corrupt the pool state, then extracted the double-counted liquidity. The same attack pattern was replicated across numerous pools on multiple chains sequentially. The attacker's execution address was 0x50275e0b7261559ce1644014d4b78d4aa63be836 and the holding address was 0xc9b826bad20872eb29f9b1d8af4befe8460b50c6.","heading":"The Exploit","sources":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"","type":"other","credibility":3},{"url":"https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1","name":"","type":"other","credibility":3},{"url":"https://blocksec.com/blog/kyberswap-incident-masterful-exploitation-of-rounding-errors-with-exceedingly-subtle-calculations","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","name":"","type":"other","credibility":3},{"url":"https://rekt.news/kyberswap-rekt","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"The attacker left multiple on-chain messages during and after the exploit. Shortly after draining funds, the exploiter posted a message stating 'Negotiations will start in a few hours when I am fully rested,' framing the theft as the opening of a negotiation rather than an outright theft. KyberSwap initially offered a 10% bounty — approximately $4.6 million — in exchange for the return of 90% of stolen funds. The offer was ignored.\n\nOn November 29, 2023, the attacker posted a lengthier on-chain message warning KyberSwap against pursuing legal action, threatening to cease negotiations if threats of law enforcement involvement continued. The attacker described themselves using the self-styled title 'Kyber Director,' signaling their subsequent demands for corporate control.\n\nAttacker wallet addresses identified in the post-mortem: execution address 0x50275e0b7261559ce1644014d4b78d4aa63be836; primary holding address 0xc9b826bad20872eb29f9b1d8af4befe8460b50c6. Subsequent on-chain tracking showed the attacker bridging approximately $2.5 million in stolen funds from Arbitrum to Ethereum in the aftermath of the hack.","heading":"On-Chain Evidence","sources":[{"url":"https://www.coindesk.com/business/2023/11/24/kyberswap-offers-10-bounty-to-attacker-who-made-off-with-50m","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/kyberswap-dex-exploiter-bounty-negotiation-message-on-chain","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/kyberswap-hacker-bridges-stolen-funds","name":"","type":"other","credibility":3},{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On approximately November 30, 2023, the attacker — adopting the handle @Kyber_Director on Telegram and the title 'Kyber Director' — published an extended on-chain letter demanding full control of Kyber Network in exchange for returning a portion of the stolen funds. The demands included: complete executive control of Kyber Network; full, temporary authority and ownership over KyberDAO; access to all internal company documentation including financials, operations, salaries, investor details, assets, and liabilities; and forfeiture of all company assets including tokens, shares, intellectual property, and social media accounts.\n\nAs a concession, the attacker stated that non-executive employees would be retained and have their salaries doubled. Departing executives would receive buyouts at 'fair valuation,' and departing staff would receive 12-month severance. Liquidity providers affected by the exploit would receive a 50% rebate on losses. The deadline for acceptance was December 10, 2023, with the explicit warning that if any government entity contacted the attacker, all negotiations would terminate and no funds would be returned.\n\nDecrypt reported notable language from the message including: 'You will be wished well in your future endeavors. You haven't done anything wrong... Simply bad luck.' KyberSwap did not comply with the demands. Kyber Network instead launched a treasury grant program on December 2, 2023 to compensate affected users without negotiating with the attacker. The December 10 deadline passed without resolution, and no significant portion of funds was returned voluntarily.","heading":"Hacker's Ultimatum","sources":[{"url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/265429/kyber-hacker-control-message","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/kyberswap-hacker-demands-complete-control-over-kyber-company","name":"","type":"other","credibility":3},{"url":"https://bitcoinist.com/kyberswap-compensate-victims-deadline-gets-closer/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"KyberSwap recovered approximately $5.87 million in total: roughly $5.17 million from front-running bots that had also extracted funds during the chaos, and approximately $706,000 in assets that remained locked in contracts. The vast majority of the approximately $48–56 million stolen was not recovered.\n\nOn December 24, 2023, Kyber Network CEO Victor Tran announced a 50% reduction in the company's workforce of over 100 people, describing it as 'among the most challenging' decisions of his entrepreneurial career. Tran stated the reduction was necessary to sustain operations after the financial damage of the exploit. Initiatives including the KyberSwap liquidity protocol and the KyberAI project were paused; the KyberSwap Aggregator and Limit Order functions were maintained.\n\nKyberSwap launched a Treasury Grant Program on December 20, 2023, offering affected users two options: 60% of lost asset value vested in USD stablecoins over three months (Option A), or 100% of lost asset value vested in USD stablecoins over twelve months (Option B). Approximately 2,367 liquidity providers were eligible.\n\nIn February 2025, U.S. prosecutors in the Eastern District of New York unsealed an indictment charging Canadian national Andean Medjedovic, 22, with wire fraud, unauthorized damage to a protected computer, attempted Hobbs Act extortion, money laundering conspiracy, and money laundering — alleging he stole a combined $65 million from KyberSwap and the earlier Indexed Finance hack in 2021. Medjedovic had previously spent 105 days in Serbian custody following an Interpol Red Notice, but a Belgrade court declined extradition, ruling Dutch prosecutors had not sufficiently proven his identity as the perpetrator and that the alleged offenses carried insufficient domestic sentences to warrant extradition. As of mid-2026, Medjedovic remains a fugitive; reports suggest he may be in Bosnia. Maximum statutory penalties on the U.S. charges total 90 years in prison.","heading":"Recovery & Layoffs","sources":[{"url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit","name":"","type":"other","credibility":3},{"url":"https://crypto.news/kyberswap-laid-off-50-of-workforce-after-54m-elastic-exploit/","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","name":"","type":"other","credibility":3},{"url":"https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/andean-medjedovic-kyberswap-alleged-hacker","name":"","type":"other","credibility":3},{"url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"KyberSwap Elastic represents one of the most severe documented cases of a smart contract exploit in DeFi history. Key risk factors include:\n\n1. Total capital loss: The exploit drained virtually all TVL from KyberSwap Elastic pools — TVL fell from $71–86 million to under $3–7 million. The majority of the approximately $48–56 million stolen was never recovered, despite the attacker's prolonged negotiation posture.\n\n2. Audit failure: The vulnerability existed in contracts that had undergone multiple professional security audits, including by ChainSecurity. The exploited rounding error was described by multiple security researchers as extraordinarily subtle — failing safety checks by less than 0.00000000001% — illustrating the limitations of code audits for complex mathematical invariants in AMM design.\n\n3. Multi-chain simultaneous attack: The attacker replicated the exploit across at least six chains (Arbitrum, Optimism, Ethereum, Polygon, Base, Avalanche) in a single coordinated attack, draining all accessible pools before the team could respond.\n\n4. Alleged perpetrator at large: As of mid-2026, the U.S. DOJ's indicted suspect Andean Medjedovic remains a fugitive. Stolen funds are not known to have been fully recovered or returned. Medjedovic evaded Serbian extradition proceedings and is alleged to have used fake passports to travel internationally.\n\n5. Organizational impact: The 50% workforce reduction, pausing of core protocol features, and long-tail compensation obligations suggest lasting structural damage to the project. KyberSwap Elastic's liquidity protocol has been paused and was not immediately relaunched after the exploit.\n\n6. Historical pattern: KyberSwap also suffered a separate frontend exploit in September 2022, indicating a broader pattern of security incidents at the organization.\n\nUsers with funds in KyberSwap Elastic should be aware that the protocol suffered catastrophic and largely unrecovered losses. The treasury grant program provided partial compensation, but the protocol's operational status and security posture as of 2025–2026 has not returned to pre-exploit levels.","heading":"Risk Assessment","sources":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","name":"","type":"other","credibility":3},{"url":"https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi","name":"","type":"other","credibility":3},{"url":"https://blog.kyberswap.com/post-mortem-past-kyberswap-frontend-exploit-sept-2022/","name":"","type":"other","credibility":3},{"url":"https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-12","event":"KyberSwap Elastic concentrated liquidity protocol launches.","source":"","date_original":"2021-12-01"},{"date":"2022-09","event":"KyberSwap suffers a separate frontend exploit; no user funds reported lost from smart contracts.","source":"","date_original":"2022-09-01"},{"date":"2023-05","event":"Hardened KyberSwap Elastic contracts re-deployed following a vulnerability disclosure and ChainSecurity audit; no funds lost during upgrade.","source":"","date_original":"2023-05-01"},{"date":"2023-11-22","event":"Exploit begins; attacker drains approximately $48–56 million from KyberSwap Elastic pools across Arbitrum, Optimism, Ethereum, Polygon, Base, and Avalanche using a flash loan and precision rounding bug.","source":""},{"date":"2023-11-23","event":"KyberNetwork confirms the security incident. Liquidity additions suspended across all Elastic pools. Attacker posts on-chain message: 'Negotiations will start in a few hours when I am fully rested.'","source":""},{"date":"2023-11-24","event":"KyberSwap offers the attacker a 10% bounty (~$4.6M) in exchange for return of 90% of stolen funds.","source":""},{"date":"2023-11-29","event":"Attacker posts on-chain warning against legal threats, escalating the standoff.","source":""},{"date":"2023-11-30","event":"Attacker publishes extended on-chain ultimatum demanding full executive and DAO control of Kyber Network, setting a December 10 deadline.","source":""},{"date":"2023-12-02","event":"KyberSwap announces Treasury Grant Program to compensate victims, declining to meet the attacker's demands.","source":""},{"date":"2023-12-10","event":"Attacker's deadline passes; no resolution. Funds are not returned.","source":""},{"date":"2023-12-20","event":"KyberSwap Treasury Grant Program opens; offers 60% (3-month vesting) or 100% (12-month vesting) compensation in USD stablecoins to approximately 2,367 affected liquidity providers.","source":""},{"date":"2023-12-24","event":"Kyber Network CEO Victor Tran announces 50% workforce reduction. Liquidity protocol and KyberAI paused.","source":""},{"date":"2024","event":"Andean Medjedovic, a Canadian national, is held in Belgrade, Serbia for approximately 105 days following an Interpol Red Notice, but is released after a Serbian court declines to extradite him.","source":"","date_original":"2024-01-01"},{"date":"2025-02-03","event":"U.S. DOJ unseals indictment against Canadian national Andean Medjedovic, 22, charging him with wire fraud, computer hacking, attempted extortion, and money laundering for alleged $65M in hacks of KyberSwap and Indexed Finance. Medjedovic remains a fugitive.","source":""}],"sources_used":[{"url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260412060634/https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","credibility":3,"archive_timestamp":"2026-04-12T06:06:34+00:00"},{"url":"https://www.chainsecurity.com/security-audit/kyberswap-elastic","name":"","type":"other","archive_url":"http://web.archive.org/web/20260710090557/https://www.chainsecurity.com/security-audit/kyberswap-elastic","credibility":3,"archive_timestamp":"2026-07-10T09:05:57+00:00"},{"url":"https://docs.kyberswap.com/reference/legacy/audits","name":"","type":"other","archive_url":"http://web.archive.org/web/20260414084238/https://docs.kyberswap.com/reference/legacy/audits","credibility":3,"archive_timestamp":"2026-04-14T08:42:38+00:00"},{"url":"https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1","name":"","type":"other","archive_url":"http://web.archive.org/web/20260606075636/https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1","credibility":3,"archive_timestamp":"2026-06-06T07:56:36+00:00"},{"url":"https://blocksec.com/blog/kyberswap-incident-masterful-exploitation-of-rounding-errors-with-exceedingly-subtle-calculations","name":"","type":"other","archive_url":"http://web.archive.org/web/20260416012046/https://blocksec.com/blog/kyberswap-incident-masterful-exploitation-of-rounding-errors-with-exceedingly-subtle-calculations","credibility":3,"archive_timestamp":"2026-04-16T01:20:46+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","name":"","type":"other","archive_url":"http://web.archive.org/web/20260525194207/https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","credibility":3,"archive_timestamp":"2026-05-25T19:42:07+00:00"},{"url":"https://rekt.news/kyberswap-rekt","name":"","type":"other","archive_url":"http://web.archive.org/web/20260607072405/https://rekt.news/kyberswap-rekt","credibility":3,"archive_timestamp":"2026-06-07T07:24:05+00:00"},{"url":"https://www.coindesk.com/business/2023/11/24/kyberswap-offers-10-bounty-to-attacker-who-made-off-with-50m","name":"","type":"other","archive_url":"http://web.archive.org/web/20251201102240/https://www.coindesk.com/business/2023/11/24/kyberswap-offers-10-bounty-to-attacker-who-made-off-with-50m","credibility":3,"archive_timestamp":"2025-12-01T10:22:40+00:00"},{"url":"https://cointelegraph.com/news/kyberswap-dex-exploiter-bounty-negotiation-message-on-chain","name":"","type":"other","archive_url":"http://web.archive.org/web/20260310130425/https://cointelegraph.com/news/kyberswap-dex-exploiter-bounty-negotiation-message-on-chain","credibility":3,"archive_timestamp":"2026-03-10T13:04:25+00:00"},{"url":"https://cointelegraph.com/news/kyberswap-hacker-bridges-stolen-funds","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829130835/https://cointelegraph.com/news/kyberswap-hacker-bridges-stolen-funds","credibility":3,"archive_timestamp":"2026-08-29T13:08:35+00:00"},{"url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter","name":"","type":"other","archive_url":"http://web.archive.org/web/20260510025649/https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter","credibility":3,"archive_timestamp":"2026-05-10T02:56:49+00:00"},{"url":"https://www.theblock.co/post/265429/kyber-hacker-control-message","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cointelegraph.com/news/kyberswap-hacker-demands-complete-control-over-kyber-company","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829182554/https://cointelegraph.com/news/kyberswap-hacker-demands-complete-control-over-kyber-company","credibility":3,"archive_timestamp":"2026-08-29T18:25:54+00:00"},{"url":"https://bitcoinist.com/kyberswap-compensate-victims-deadline-gets-closer/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829232906/https://bitcoinist.com/kyberswap-compensate-victims-deadline-gets-closer/","credibility":3,"archive_timestamp":"2026-08-29T23:29:06+00:00"},{"url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260606134350/https://blog.kyberswap.com/kyberswap-treasury-grant-program/","credibility":3,"archive_timestamp":"2026-06-06T13:43:50+00:00"},{"url":"https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit","name":"","type":"other","archive_url":"http://web.archive.org/web/20240415202951/https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit","credibility":3,"archive_timestamp":"2024-04-15T20:29:51+00:00"},{"url":"https://crypto.news/kyberswap-laid-off-50-of-workforce-after-54m-elastic-exploit/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251015054722/https://crypto.news/kyberswap-laid-off-50-of-workforce-after-54m-elastic-exploit/","credibility":3,"archive_timestamp":"2025-10-15T05:47:22+00:00"},{"url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","name":"","type":"other","archive_url":"http://web.archive.org/web/20260728015123/https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","credibility":3,"archive_timestamp":"2026-07-28T01:51:23+00:00"},{"url":"https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi","name":"","type":"other","archive_url":"http://web.archive.org/web/20260524220712/https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi","credibility":3,"archive_timestamp":"2026-05-24T22:07:12+00:00"},{"url":"https://cointelegraph.com/news/andean-medjedovic-kyberswap-alleged-hacker","name":"","type":"other","archive_url":"http://web.archive.org/web/20251213110912/https://cointelegraph.com/news/andean-medjedovic-kyberswap-alleged-hacker","credibility":3,"archive_timestamp":"2025-12-13T11:09:12+00:00"},{"url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147","name":"","type":"other","archive_url":"http://web.archive.org/web/20260206091129/https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147","credibility":3,"archive_timestamp":"2026-02-06T09:11:29+00:00"},{"url":"https://blog.kyberswap.com/post-mortem-past-kyberswap-frontend-exploit-sept-2022/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260801141024/https://blog.kyberswap.com/post-mortem-past-kyberswap-frontend-exploit-sept-2022/","credibility":3,"archive_timestamp":"2026-08-01T14:10:24+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:36.795209+00:00","updated_at":"2026-08-30T01:16:29.298903+00:00"}}