KyberSwap Elastic
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 57. Problems weighed by who is responsible: incidents the subject suffered −12.8, problems around the subject, caused by others −1.6; legitimacy credit long-running +6. Version history →
Why this score
| Every page starts at | 65 |
| Incidents it suffered (e.g. hacks) | -12.8 |
| Problems around it, caused by others | -1.6 |
| Long-running | +6 |
| Sum | 57 |
Score: 57/100 (kept between 0 and 100)
How scoring works →Summary
KyberSwap Elastic is the concentrated liquidity automated market maker (AMM) component of Kyber Network, a decentralized exchange protocol deployed across more than a dozen EVM-compatible blockchains. On November 22–23, 2023, it suffered the largest DeFi exploit of that year — approximately $48–56 million drained via a precision rounding bug in its tick-crossing swap logic — after which the alleged attacker issued an on-chain ultimatum demanding full executive control of the company. Canadian national Andean Medjedovic was indicted by U.S. prosecutors in February 2025 on charges including wire fraud, computer hacking, and extortion; he remains a fugitive as of mid-2026.
Connected Entities
13 entities · 60 linked investigations- KyberSwap Elastic→mentioned with→Ethereum(70%)
- KyberSwap Elastic→mentioned with→Polygon(70%)
- KyberSwap Elastic→mentioned with→Optimism(70%)
- Indexed Finance→mentioned with→Uniswap(65%)
- Indexed Finance→mentioned with→Ethereum(70%)
- KyberSwap Elastic→mentioned with→Arbitrum(70%)
- KyberSwap Elastic→mentioned with→Scroll(60%)
- KyberSwap Elastic→mentioned with→KyberSwap(80%)
- KyberSwap Elastic→mentioned with→Uniswap(60%)
- Indexed Finance→mentioned with→KyberSwap(70%)
- + 39 more
Timeline(14 events)
December 2021
KyberSwap Elastic concentrated liquidity protocol launches.
September 2022
KyberSwap suffers a separate frontend exploit; no user funds reported lost from smart contracts.
May 2023
Hardened KyberSwap Elastic contracts re-deployed following a vulnerability disclosure and ChainSecurity audit; no funds lost during upgrade.
22 November 2023
Exploit begins; attacker drains approximately $48–56 million from KyberSwap Elastic pools across Arbitrum, Optimism, Ethereum, Polygon, Base, and Avalanche using a flash loan and precision rounding bug.
23 November 2023
KyberNetwork confirms the security incident. Liquidity additions suspended across all Elastic pools. Attacker posts on-chain message: 'Negotiations will start in a few hours when I am fully rested.'
24 November 2023
KyberSwap offers the attacker a 10% bounty (~$4.6M) in exchange for return of 90% of stolen funds.
29 November 2023
Attacker posts on-chain warning against legal threats, escalating the standoff.
30 November 2023
Attacker publishes extended on-chain ultimatum demanding full executive and DAO control of Kyber Network, setting a December 10 deadline.
2 December 2023
KyberSwap announces Treasury Grant Program to compensate victims, declining to meet the attacker's demands.
10 December 2023
Attacker's deadline passes; no resolution. Funds are not returned.
20 December 2023
KyberSwap Treasury Grant Program opens; offers 60% (3-month vesting) or 100% (12-month vesting) compensation in USD stablecoins to approximately 2,367 affected liquidity providers.
24 December 2023
Kyber Network CEO Victor Tran announces 50% workforce reduction. Liquidity protocol and KyberAI paused.
2024
Andean Medjedovic, a Canadian national, is held in Belgrade, Serbia for approximately 105 days following an Interpol Red Notice, but is released after a Serbian court declines to extradite him.
3 February 2025
U.S. DOJ unseals indictment against Canadian national Andean Medjedovic, 22, charging him with wire fraud, computer hacking, attempted extortion, and money laundering for alleged $65M in hacks of KyberSwap and Indexed Finance. Medjedovic remains a fugitive.
Decision Log
- slot 455368436 · hash Ec5g9RK4GjedmHggUnTwmBXhuw6FSfT7AwJuYaHXfV5m
- slot 421014705 · hash 8U8x6duqNRPVJo5FttUQjLZyAuwj3VJVUuGgQ59eBNoD
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 21 of 22 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:36 AM
last updated: 10/10/2026, 6:48:34 PM
5 viewsavoid.net — verified advice for a post-truth world