Audit log

Every state-changing event for KyberSwap Classic: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions carry three independent witnesses — the original source, an Internet Archive snapshot taken at submission time, and a Solana memo signed by our publicly-disclosed publisher key.

1. #1publishby system:backfill

   2026-05-30 12:11:26Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 423,153,837

   sig

   2CG9YMs811gU…vPLgKz4rcopyexplorer ↗

   hash

   Ad9hmJHVPjLD…hEYpQYKhcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (16583 B) ▸

   {"actor":"system:backfill","investigation_id":"75e5b15f-7663-4518-9918-5f4b1da05038","kind":"publish","page_slug":"kyberswap-classic","published_at":"2026-05-30T12:11:26.245Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"KyberSwap Classic","sections":[{"content":"","heading":"","severity":"low","sources":[{"credibility":1,"name":"Introduction to KyberSwap — KyberSwap Docs","type":"official","url":"https://docs.kyberswap.com/"},{"credibility":1,"name":"What is the Difference Between KyberSwap Classic and KyberSwap Elastic? — KyberSwap Help Center","type":"official","url":"https://support.kyberswap.com/hc/en-us/articles/13766696328729-What-is-the-Difference-Between-KyberSwap-Classic-and-KyberSwap-Elastic"},{"credibility":1,"name":"Announcing Our New KyberSwap Protocol — KyberSwap Elastic — KyberSwap Blog","type":"official","url":"https://blog.kyberswap.com/announcing-our-new-kyberswap-protocol-kyberswap-elastic/"}]},{"content":"","heading":"","severity":"critical","sources":[{"credibility":1,"name":"Post Mortem: KyberSwap Elastic Exploit November 2023 — KyberSwap Blog","type":"official","url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/"},{"credibility":2,"name":"KyberSwap's $47M Reentrancy Attack: A Deep Dive into the Exploit — Hacken","type":"research","url":"https://hacken.io/insights/kyberswap-hack-explained/"},{"credibility":2,"name":"Explained: The KyberSwap Hack (November 2023) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023"},{"credibility":2,"name":"Yet Another Tragedy of Precision Loss: An In-Depth Analysis of the KyberSwap Incident — BlockSec","type":"research","url":"https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1"},{"credibility":1,"name":"KyberSwap DEX Hacked for $48 Million, Attacker Teases Negotiations — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2023/11/23/kyberswap-dex-hacked-for-48-million-attacker-teases-negotiations"}]},{"content":"","heading":"","severity":"critical","sources":[{"credibility":2,"name":"KyberSwap Hacker Demands Company Control in Unhinged On-Chain Ransom Letter — Decrypt","type":"news_article","url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter"},{"credibility":2,"name":"KyberSwap hacker demands full control in bizarre on-chain message — The Block","type":"news_article","url":"https://www.theblock.co/post/265429/kyber-hacker-control-message"},{"credibility":2,"name":"KyberSwap hacker demands complete control over Kyber company — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/kyberswap-hacker-demands-complete-control-over-kyber-company"},{"credibility":1,"name":"Canadian Man Charged in $65M Cryptocurrency Hacking Schemes — U.S. Department of Justice","type":"regulatory","url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes"}]},{"content":"","heading":"","severity":"critical","sources":[{"credibility":1,"name":"Canadian Man Charged in $65M Cryptocurrency Hacking Schemes — U.S. Department of Justice","type":"regulatory","url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes"},{"credibility":1,"name":"U.S. Prosecutors Charge Canadian Man With $65M Hacks of Indexed Finance, KyberSwap — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap"},{"credibility":2,"name":"Who is Andean Medjedovic, the alleged $48M KyberSwap hacker? — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/andean-medjedovic-kyberswap-alleged-hacker"},{"credibility":1,"name":"Fake passports, $65M US and an Interpol Red Notice: Canadian crypto fugitive vanishes after arrest in Serbia — CBC News","type":"news_article","url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"credibility":2,"name":"Fugitive Canadian Hacker, Released by Serbia, Seeks Pardon from Trump — Balkan Insight","type":"news_article","url":"https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/"}]},{"content":"","heading":"","severity":"high","sources":[{"credibility":1,"name":"Audits — KyberSwap Docs","type":"official","url":"https://docs.kyberswap.com/reference/legacy/audits"},{"credibility":2,"name":"KyberSwap Elastic — ChainSecurity Smart Contract Audit","type":"research","url":"https://www.chainsecurity.com/security-audit/kyberswap-elastic"},{"credibility":2,"name":"Sherlock Audit Contest — kyber-swap (July 2023)","type":"research","url":"https://github.com/sherlock-audit/2023-07-kyber-swap"},{"credibility":1,"name":"Post Mortem: Past KyberSwap Frontend Exploit (Sept 2022) — KyberSwap Blog","type":"official","url":"https://blog.kyberswap.com/post-mortem-past-kyberswap-frontend-exploit-sept-2022/"}]},{"content":"","heading":"","severity":"high","sources":[{"credibility":1,"name":"KyberSwap Treasury Grant Program for Affected Users — KyberSwap Blog","type":"official","url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/"},{"credibility":1,"name":"Treasury Grant Program Registration for Affected Users — KyberSwap Blog","type":"official","url":"https://blog.kyberswap.com/kyberswap-elastic-exploit-treasury-grant-program-registration/"},{"credibility":2,"name":"KyberSwap announces treasury grants for hack victims — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/kyberswap-announces-treasury-grants-for-hack-victims"},{"credibility":2,"name":"KyberSwap laid off 50% of workforce after $54m Elastic exploit — crypto.news","type":"news_article","url":"https://crypto.news/kyberswap-laid-off-50-of-workforce-after-54m-elastic-exploit/"},{"credibility":2,"name":"KyberSwap Resumes Elastic Protocol, Backed By KyberDAO Security Fund — BeInCrypto","type":"news_article","url":"https://beincrypto.com/kyberswap-resumes-elastic-protocol-backed-by-kyberdao-security-fund/"}]},{"content":"","heading":"","severity":"high","sources":[{"credibility":2,"name":"KyberSwap Hacker Uncovered: Attack Analysis — Nominis Insights","type":"on_chain","url":"https://www.nominis.io/insights/kyberswap-hacker-uncovered"},{"credibility":2,"name":"A Deep Dive Into the KyberSwap Hack — SlowMist (Medium)","type":"research","url":"https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3805d3a"},{"credibility":2,"name":"Top Ten Security Incidents in 2023 — BlockSec","type":"research","url":"https://blocksec.com/blog/top-ten-awesome-security-incidents-in-2023"}]}],"sources_used":[{"credibility":1,"name":"Post Mortem: KyberSwap Elastic Exploit November 2023 — KyberSwap Blog","type":"official","url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/"},{"credibility":1,"name":"Canadian Man Charged in $65M Cryptocurrency Hacking Schemes — U.S. Department of Justice","type":"regulatory","url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes"},{"credibility":1,"name":"KyberSwap DEX Hacked for $48 Million, Attacker Teases Negotiations — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2023/11/23/kyberswap-dex-hacked-for-48-million-attacker-teases-negotiations"},{"credibility":1,"name":"U.S. Prosecutors Charge Canadian Man With $65M Hacks of Indexed Finance, KyberSwap — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap"},{"credibility":2,"name":"KyberSwap Hacker Demands Company Control in Unhinged On-Chain Ransom Letter — Decrypt","type":"news_article","url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter"},{"credibility":2,"name":"KyberSwap hacker demands full control in bizarre on-chain message — The Block","type":"news_article","url":"https://www.theblock.co/post/265429/kyber-hacker-control-message"},{"credibility":2,"name":"KyberSwap's $47M Reentrancy Attack: A Deep Dive — Hacken","type":"research","url":"https://hacken.io/insights/kyberswap-hack-explained/"},{"credibility":2,"name":"Explained: The KyberSwap Hack (November 2023) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023"},{"credibility":2,"name":"Yet Another Tragedy of Precision Loss — BlockSec","type":"research","url":"https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1"},{"credibility":1,"name":"KyberSwap Treasury Grant Program — KyberSwap Blog","type":"official","url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/"},{"credibility":1,"name":"Treasury Grant Program Registration — KyberSwap Blog","type":"official","url":"https://blog.kyberswap.com/kyberswap-elastic-exploit-treasury-grant-program-registration/"},{"credibility":2,"name":"KyberSwap laid off 50% of workforce — crypto.news","type":"news_article","url":"https://crypto.news/kyberswap-laid-off-50-of-workforce-after-54m-elastic-exploit/"},{"credibility":1,"name":"Fake passports, $65M US and an Interpol Red Notice — CBC News","type":"news_article","url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"credibility":2,"name":"Canadian crypto fugitive surfaces in Bosnia — Balkan Insight","type":"news_article","url":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/"},{"credibility":2,"name":"Fugitive Canadian Hacker Seeks Pardon from Trump — Balkan Insight","type":"news_article","url":"https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/"},{"credibility":2,"name":"KyberSwap Elastic — ChainSecurity Security Audit","type":"research","url":"https://www.chainsecurity.com/security-audit/kyberswap-elastic"},{"credibility":2,"name":"Sherlock Audit Contest 2023-07-kyber-swap — GitHub","type":"research","url":"https://github.com/sherlock-audit/2023-07-kyber-swap"},{"credibility":2,"name":"KyberSwap Hacker Uncovered: Attack Analysis — Nominis Insights","type":"on_chain","url":"https://www.nominis.io/insights/kyberswap-hacker-uncovered"},{"credibility":2,"name":"KyberSwap Resumes Elastic Protocol Backed By KyberDAO Security Fund — BeInCrypto","type":"news_article","url":"https://beincrypto.com/kyberswap-resumes-elastic-protocol-backed-by-kyberdao-security-fund/"},{"credibility":1,"name":"Audits — KyberSwap Docs","type":"official","url":"https://docs.kyberswap.com/reference/legacy/audits"}],"summary":"KyberSwap is a decentralized exchange (DEX) and liquidity protocol operated by Kyber Network. In November 2023, KyberSwap Elastic — the protocol's concentrated liquidity layer — suffered one of the largest DEX exploits of the year, with approximately $48.9 million drained across thirteen chains via a sophisticated tick-manipulation and rounding-error attack. The alleged attacker, Canadian national Andean Medjedovic, was subsequently indicted by U.S. federal prosecutors on five felony counts and remains a fugitive as of mid-2026.","timeline":[{"date":"2021-12-01","event":"KyberSwap Elastic (concentrated liquidity protocol) launched.","source":"KyberSwap Blog","source_url":"https://blog.kyberswap.com/announcing-our-new-kyberswap-protocol-kyberswap-elastic/"},{"date":"2022-09-01","event":"KyberSwap frontend exploit detected — a malicious script injected via a compromised third-party dependency redirected user approvals. No smart contract funds were drained.","source":"KyberSwap Blog","source_url":"https://blog.kyberswap.com/post-mortem-past-kyberswap-frontend-exploit-sept-2022/"},{"date":"2023-05-16","event":"KyberSwap Elastic smart contracts redeployed after hardening; ChainSecurity completes final audit finding all issues resolved except one accepted low-severity item.","source":"KyberSwap Docs","source_url":"https://docs.kyberswap.com/reference/legacy/audits"},{"date":"2023-09-01","event":"Sherlock community audit contest involving 207 participants concludes. The tick-rounding vulnerability is not identified.","source":"Sherlock GitHub","source_url":"https://github.com/sherlock-audit/2023-07-kyber-swap"},{"date":"2023-11-22","event":"KyberSwap Elastic exploited across 13 chains. Approximately $48.7 million taken by the primary exploiter; an additional $6.6 million extracted by front-running MEV bots. KyberSwap suspends liquidity additions across all chains within minutes.","source":"KyberSwap Blog Post-Mortem","source_url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/"},{"date":"2023-11-23","event":"CoinDesk reports the exploit publicly. Total value locked drops from approximately $86 million to $7.17 million — a roughly 90% decline.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2023/11/23/kyberswap-dex-hacked-for-48-million-attacker-teases-negotiations"},{"date":"2023-11-30","event":"Attacker publishes on-chain message signed as 'Kyber Director' demanding full executive and governance control of Kyber Network, access to all internal documents and assets, and setting a December 10, 2023 deadline for acceptance.","source":"Decrypt","source_url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter"},{"date":"2023-12-01","event":"Kyber Network announces Treasury Grant Program to compensate affected users up to the reference value of lost funds.","source":"KyberSwap Blog","source_url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/"},{"date":"2023-12-10","event":"Attacker's self-imposed deadline for KyberSwap to accept demands passes with no public acceptance from Kyber Network.","source":"Decrypt","source_url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter"},{"date":"2024-01-01","event":"Kyber Network lays off approximately 50% of its workforce and pauses KyberAI and certain liquidity protocol initiatives following post-exploit financial stress.","source":"crypto.news","source_url":"https://crypto.news/kyberswap-laid-off-50-of-workforce-after-54m-elastic-exploit/"},{"date":"2024-01-19","event":"Treasury Grant Program UI goes live. MEV bot operators voluntarily return approximately $5.17 million of front-run assets.","source":"KyberSwap Blog","source_url":"https://blog.kyberswap.com/kyberswap-elastic-exploit-treasury-grant-program-registration/"},{"date":"2024-02-01","event":"Treasury Grant vesting commences for eligible affected users.","source":"KyberSwap Blog","source_url":"https://blog.kyberswap.com/kyberswap-elastic-exploit-treasury-grant-program-registration/"},{"date":"2024-09-01","event":"Andean Medjedovic arrested in Belgrade, Serbia.","source":"CBC News","source_url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"date":"2024-11-01","event":"Medjedovic released by Serbian authorities after 105 days. The High Court of Belgrade rules Dutch prosecutors failed to sufficiently establish his identity as perpetrator and that the equivalent domestic offense carried insufficient sentencing to justify extradition.","source":"CBC News","source_url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"date":"2025-02-03","event":"U.S. Department of Justice unseals five-count criminal indictment against Andean Medjedovic in the Eastern District of New York, charging him with wire fraud, computer damage, attempted extortion, and money laundering conspiracy related to KyberSwap and the 2021 Indexed Finance exploit.","source":"U.S. Department of Justice","source_url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes"},{"date":"2026-01-30","event":"Reports indicate Medjedovic has surfaced in Bosnia after slipping Serbian authorities. U.S. DOJ confirms he remains at large.","source":"Balkan Insight","source_url":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/"},{"date":"2026-03-24","event":"Reports emerge that Medjedovic has engaged a U.S. lobbying firm for approximately $300,000 to seek a presidential pardon from the Trump administration.","source":"Balkan Insight","source_url":"https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 0405fb0a-68bb-4a17-83da-bd6fd6c95115copy