Skip to main content
AVOID.NET
Sign in

KyberSwap Classic

avoid.net/kyberswap-classic→28/100·88% conf.
[AI-DRAFTED · AWAITING VERIFICATION][src:defillama]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·2CG9YM…Kz4r

Summary

KyberSwap is a decentralized exchange (DEX) and liquidity protocol operated by Kyber Network. In November 2023, KyberSwap Elastic — the protocol's concentrated liquidity layer — suffered one of the largest DEX exploits of the year, with approximately $48.9 million drained across thirteen chains via a sophisticated tick-manipulation and rounding-error attack. The alleged attacker, Canadian national Andean Medjedovic, was subsequently indicted by U.S. federal prosecutors on five felony counts and remains a fugitive as of mid-2026.

Connected Entities

17 entities · 60 linked investigations
Organizations
□Polygon54□Ethereum□Fantom (Sonic Labs)□Avalanche□Arbitrum□Binance□Polygon zkEVM□Tectonic / Cronos — August 2026 TONIC Price Manipulation Exploit□ZachXBT□Scroll□Andean Medjedovic□Optimism
Exchanges
△Indexed Finance
Protocols
⌂KyberSwap Elastic⌂Uniswap⌂KyberSwap⌂KyberSwap Classic
Relationships
  • KyberSwap Elastic→mentioned with→Ethereum(70%)
  • KyberSwap Elastic→mentioned with→Polygon(70%)
  • KyberSwap Elastic→mentioned with→Optimism(70%)
  • Indexed Finance→mentioned with→Uniswap(65%)
  • Indexed Finance→mentioned with→Ethereum(70%)
  • KyberSwap Elastic→mentioned with→Arbitrum(70%)
  • KyberSwap Elastic→mentioned with→Scroll(60%)
  • KyberSwap Elastic→mentioned with→KyberSwap(80%)
  • KyberSwap Elastic→mentioned with→Uniswap(60%)
  • Indexed Finance→mentioned with→ZachXBT(65%)
  • + 64 more
Also appears in
Polygon·54StableMagnet·2Shibarium·28JUDAO·18Shibarium Bridge·32Andean Medjedovic·2Ionic Money·14Allo Protocol·57AnubisDAO·2SushiSwap RouteProcessor Exploit·54+ 50 more

Connected Through

15 shared actors · 521 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about KyberSwap Classic?

Timeline(17 events)

December 2021

KyberSwap Elastic (concentrated liquidity protocol) launched.

KyberSwap Blog

September 2022

KyberSwap frontend exploit detected — a malicious script injected via a compromised third-party dependency redirected user approvals. No smart contract funds were drained.

KyberSwap Blog

16 May 2023

KyberSwap Elastic smart contracts redeployed after hardening; ChainSecurity completes final audit finding all issues resolved except one accepted low-severity item.

KyberSwap Docs

September 2023

Sherlock community audit contest involving 207 participants concludes. The tick-rounding vulnerability is not identified.

Sherlock GitHub

22 November 2023

KyberSwap Elastic exploited across 13 chains. Approximately $48.7 million taken by the primary exploiter; an additional $6.6 million extracted by front-running MEV bots. KyberSwap suspends liquidity additions across all chains within minutes.

KyberSwap Blog Post-Mortem

23 November 2023

CoinDesk reports the exploit publicly. Total value locked drops from approximately $86 million to $7.17 million — a roughly 90% decline.

CoinDesk

30 November 2023

Attacker publishes on-chain message signed as 'Kyber Director' demanding full executive and governance control of Kyber Network, access to all internal documents and assets, and setting a December 10, 2023 deadline for acceptance.

Decrypt

December 2023

Kyber Network announces Treasury Grant Program to compensate affected users up to the reference value of lost funds.

KyberSwap Blog

10 December 2023

Attacker's self-imposed deadline for KyberSwap to accept demands passes with no public acceptance from Kyber Network.

Decrypt

2024

Kyber Network lays off approximately 50% of its workforce and pauses KyberAI and certain liquidity protocol initiatives following post-exploit financial stress.

crypto.news

19 January 2024

Treasury Grant Program UI goes live. MEV bot operators voluntarily return approximately $5.17 million of front-run assets.

KyberSwap Blog

February 2024

Treasury Grant vesting commences for eligible affected users.

KyberSwap Blog

September 2024

Andean Medjedovic arrested in Belgrade, Serbia.

CBC News

November 2024

Medjedovic released by Serbian authorities after 105 days. The High Court of Belgrade rules Dutch prosecutors failed to sufficiently establish his identity as perpetrator and that the equivalent domestic offense carried insufficient sentencing to justify extradition.

CBC News

3 February 2025

U.S. Department of Justice unseals five-count criminal indictment against Andean Medjedovic in the Eastern District of New York, charging him with wire fraud, computer damage, attempted extortion, and money laundering conspiracy related to KyberSwap and the 2021 Indexed Finance exploit.

U.S. Department of Justice

30 January 2026

Reports indicate Medjedovic has surfaced in Bosnia after slipping Serbian authorities. U.S. DOJ confirms he remains at large.

Balkan Insight

24 March 2026

Reports emerge that Medjedovic has engaged a U.S. lobbying firm for approximately $300,000 to seek a presidential pardon from the Trump administration.

Balkan Insight
Provenance & Audit Trail
Anchored on SolanaVerify on-chain17 Wayback Archivessrc:defillama

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 17 of 20 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-5

generated: 5/4/2026, 2:54:48 AM

last updated: 8/29/2026, 1:35:45 AM

5 views

avoid.net — verified advice for a post-truth world