KyberSwap Elastic
Summary
KyberSwap Elastic is the concentrated liquidity automated market maker (AMM) component of Kyber Network, a decentralized exchange protocol deployed across more than a dozen EVM-compatible blockchains. On November 22–23, 2023, it suffered the largest DeFi exploit of that year — approximately $48–56 million drained via a precision rounding bug in its tick-crossing swap logic — after which the alleged attacker issued an on-chain ultimatum demanding full executive control of the company. Canadian national Andean Medjedovic was indicted by U.S. prosecutors in February 2025 on charges including wire fraud, computer hacking, and extortion; he remains a fugitive as of mid-2026.
Connected Entities
1 entities- + 4 more
Timeline(14 events)
2021-12-01
KyberSwap Elastic concentrated liquidity protocol launches.
2022-09-01
KyberSwap suffers a separate frontend exploit; no user funds reported lost from smart contracts.
2023-05-01
Hardened KyberSwap Elastic contracts re-deployed following a vulnerability disclosure and ChainSecurity audit; no funds lost during upgrade.
2023-11-22
Exploit begins; attacker drains approximately $48–56 million from KyberSwap Elastic pools across Arbitrum, Optimism, Ethereum, Polygon, Base, and Avalanche using a flash loan and precision rounding bug.
2023-11-23
KyberNetwork confirms the security incident. Liquidity additions suspended across all Elastic pools. Attacker posts on-chain message: 'Negotiations will start in a few hours when I am fully rested.'
2023-11-24
KyberSwap offers the attacker a 10% bounty (~$4.6M) in exchange for return of 90% of stolen funds.
2023-11-29
Attacker posts on-chain warning against legal threats, escalating the standoff.
2023-11-30
Attacker publishes extended on-chain ultimatum demanding full executive and DAO control of Kyber Network, setting a December 10 deadline.
2023-12-02
KyberSwap announces Treasury Grant Program to compensate victims, declining to meet the attacker's demands.
2023-12-10
Attacker's deadline passes; no resolution. Funds are not returned.
2023-12-20
KyberSwap Treasury Grant Program opens; offers 60% (3-month vesting) or 100% (12-month vesting) compensation in USD stablecoins to approximately 2,367 affected liquidity providers.
2023-12-24
Kyber Network CEO Victor Tran announces 50% workforce reduction. Liquidity protocol and KyberAI paused.
2024-01-01
Andean Medjedovic, a Canadian national, is held in Belgrade, Serbia for approximately 105 days following an Interpol Red Notice, but is released after a Serbian court declines to extradite him.
2025-02-03
U.S. DOJ unseals indictment against Canadian national Andean Medjedovic, 22, charging him with wire fraud, computer hacking, attempted extortion, and money laundering for alleged $65M in hacks of KyberSwap and Indexed Finance. Medjedovic remains a fugitive.
Decision Log
- hash: 8U8x6duqNRPVJo5FttUQjLZyAuwj3VJVUuGgQ59eBNoD
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:36 AM
last updated: 5/20/2026, 3:41:06 PM
avoid.net — verified advice for a post-truth world