KyberSwap
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3VFc1u…vmLxSummary
KyberSwap is a multi-chain decentralized exchange aggregator and concentrated liquidity protocol operated by Kyber Network. On November 22, 2023, its Elastic liquidity pool contracts were exploited via a sophisticated tick-manipulation and liquidity double-counting attack, resulting in approximately $48.8 million in losses across 13 chains. The alleged attacker, Canadian national Andean Medjedovic, subsequently attempted to extort full corporate and governance control of Kyber Network in exchange for returning 50% of stolen funds; he was indicted by the U.S. Department of Justice in February 2025 and remains a fugitive.
Connected Entities
1 entities- + 6 more
Community submissions
- Under reviewincriminatingWayback pending6/21/2026, 11:11:23 AM
“Confirms active Tornado Cash laundering of KyberSwap proceeds by fugitive Medjedovic as of April 29, 2026. Also: presidential pardon lobbying effort disclosed. New evidence for existing KyberSwap page.”
— avoid-scout
Timeline(17 events)
October 2021
Indexed Finance DeFi protocol exploited for approximately $16 million. Andean Medjedovic later publicly acknowledged responsibility.
December 2021
Canadian court issues arrest warrant for Andean Medjedovic in connection with the Indexed Finance exploit. Medjedovic does not appear and becomes a fugitive.
22 November 2023
KyberSwap Elastic pools exploited via tick-manipulation and liquidity double-counting attack. Approximately $48.8 million drained from 77 pools across 13 chains. TVL drops from ~$80M to ~$22M.
22 November 2023
Kyber Network issues emergency advisory urging all users to withdraw funds from KyberSwap Elastic.
23 November 2023
Attacker posts on-chain message: 'negotiations will start in a few hours when I am fully rested,' taunting victims and referencing Ontario, Canada.
30 November 2023
Attacker, styling themselves 'Kyber Director,' posts on-chain ransom letter demanding complete executive and governance control of Kyber Network in exchange for returning 50% of stolen funds. December 10 deadline set.
December 2023
Netherlands issues a European arrest warrant for Andean Medjedovic in connection with the KyberSwap exploit. Dutch extradition documents allege the attack was carried out from a hotel in The Hague using a fake Slovak passport.
10 December 2023
Attacker's stated deadline for Kyber Network to comply with control demands passes without agreement.
20 December 2023
KyberSwap launches Treasury Grant Program offering affected users 60% immediate or 100% long-term stablecoin compensation for unrecovered losses.
24 December 2023
Kyber Network CEO Victor Tran announces 50% workforce reduction to sustain operations following the exploit.
19 January 2024
Treasury Grant Program UI opens for affected user registration and option selection.
February 2024
KyberSwap Treasury Grant vesting begins for eligible users.
September 2024
Andean Medjedovic arrested in Belgrade, Serbia, approximately nine months after the Dutch arrest warrant was issued.
17 January 2025
After 105 days in Serbian custody, Belgrade Higher Court denies Dutch extradition request. Medjedovic released and subsequently reported to be at large in Bosnia per DOJ filing.
3 February 2025
U.S. Department of Justice (EDNY) unseals federal indictment against Andean Medjedovic charging five counts including wire fraud, CFAA violations, Hobbs Act extortion, and money laundering conspiracy, covering $65 million across KyberSwap and Indexed Finance.
30 January 2026
Reports confirm Medjedovic has resurfaced in Bosnia after escaping Serbian custody. Interpol Red Notice remains active.
24 March 2026
Reports indicate Medjedovic has hired Washington D.C. lobbyists at a reported cost of $300,000 to pursue a presidential pardon.
Decision Log
- hash: wcdPZTm1Y78J6oXrXNjwL2CDFCnT5qxbfxXWSRoK6Q9
- hash: 73i7eZvdC7DfWao8QjuzmMBJj82cMXbP7ryCYTA4LJVi
- hash: CyjLUXoH3jFcxRSSSDXMcZ9EYRDtAhfJYA1hCbfckehJ
This investigation is cryptographically anchored to the Solana blockchain (3 events). 16 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/30/2026, 6:25:24 PM
last updated: 8/29/2026, 1:33:38 AM
avoid.net — verified advice for a post-truth world