KyberSwap Classic

2021-12-01

KyberSwap Elastic (concentrated liquidity protocol) launched.

2022-09-01

KyberSwap frontend exploit detected — a malicious script injected via a compromised third-party dependency redirected user approvals. No smart contract funds were drained.

2023-05-16

KyberSwap Elastic smart contracts redeployed after hardening; ChainSecurity completes final audit finding all issues resolved except one accepted low-severity item.

2023-09-01

Sherlock community audit contest involving 207 participants concludes. The tick-rounding vulnerability is not identified.

2023-11-22

KyberSwap Elastic exploited across 13 chains. Approximately $48.7 million taken by the primary exploiter; an additional $6.6 million extracted by front-running MEV bots. KyberSwap suspends liquidity additions across all chains within minutes.

2023-11-23

CoinDesk reports the exploit publicly. Total value locked drops from approximately $86 million to $7.17 million — a roughly 90% decline.

2023-11-30

Attacker publishes on-chain message signed as 'Kyber Director' demanding full executive and governance control of Kyber Network, access to all internal documents and assets, and setting a December 10, 2023 deadline for acceptance.

2023-12-01

Kyber Network announces Treasury Grant Program to compensate affected users up to the reference value of lost funds.

2023-12-10

Attacker's self-imposed deadline for KyberSwap to accept demands passes with no public acceptance from Kyber Network.

2024-01-01

Kyber Network lays off approximately 50% of its workforce and pauses KyberAI and certain liquidity protocol initiatives following post-exploit financial stress.

2024-01-19

Treasury Grant Program UI goes live. MEV bot operators voluntarily return approximately $5.17 million of front-run assets.

2024-02-01

Treasury Grant vesting commences for eligible affected users.

2024-09-01

Andean Medjedovic arrested in Belgrade, Serbia.

2024-11-01

Medjedovic released by Serbian authorities after 105 days. The High Court of Belgrade rules Dutch prosecutors failed to sufficiently establish his identity as perpetrator and that the equivalent domestic offense carried insufficient sentencing to justify extradition.

2025-02-03

U.S. Department of Justice unseals five-count criminal indictment against Andean Medjedovic in the Eastern District of New York, charging him with wire fraud, computer damage, attempted extortion, and money laundering conspiracy related to KyberSwap and the 2021 Indexed Finance exploit.

2026-01-30

Reports indicate Medjedovic has surfaced in Bosnia after slipping Serbian authorities. U.S. DOJ confirms he remains at large.

2026-03-24

Reports emerge that Medjedovic has engaged a U.S. lobbying firm for approximately $300,000 to seek a presidential pardon from the Trump administration.