Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #13[disputed][awaiting moderator]in section: DOJ Indictment of Alleged Attacker Andean Medjedovic

   “Medjedovic was arrested in Belgrade, Serbia, approximately nine months after the Dutch warrant was issued.”

   reviewerMedjedovic arrested in Belgrade, Serbia, approximately nine months after the Dutch warrant was issuedMultiple sources place the Dutch warrant in December 2023 and the arrest on August 9, 2024, a gap of roughly eight months, not nine as stated.
   Proposed correction (not yet applied)

   Medjedovic was arrested in Belgrade, Serbia, approximately eight months after the Dutch warrant was issued.
   citedwww.cbc.ca/news/world/canadian-alleged-c…y-hack-9.7066147
2. #14[disputed][awaiting moderator]in the timeline

   “2024-09”

   reviewerTimeline: Medjedovic arrested in Belgrade in September 2024The stored timeline date of 2024-09 is a month later than the well-corroborated August 9, 2024 arrest date.
   Proposed correction (not yet applied)

   2024-08
   citedwww.cbc.ca/news/world/canadian-alleged-c…y-hack-9.7066147
3. #15[disputed][awaiting moderator]in the timeline

   “2025-01-17”

   reviewerTimeline: Belgrade Higher Court denies extradition and Medjedovic is released after 105 days in custody, dated 2025-01-17This entry conflates two distinct events at two different dates: the actual extradition denial/release (~Nov 22, 2024) and a later DOJ filing (Jan 17, 2025) reporting his presumed location in Bosnia. As stored, the date field attaches the release event to the wrong date.
   Proposed correction (not yet applied)

   2024-11-22
   citedwww.cbc.ca/news/world/canadian-alleged-c…y-hack-9.7066147

No source the reviewer could reach confirms or contradicts the claim.

1. #16[unverifiable][awaiting moderator]in section: DOJ Indictment of Alleged Attacker Andean Medjedovic

   “He has publicly described living as a fugitive across Europe, South America, and an unnamed island nation.”

   reviewerMedjedovic has publicly described living as a fugitive across Europe, South America, and an unnamed island nationDirectionally plausible (Brazil is in South America) but the specific 'unnamed island nation' detail could not be independently confirmed; the primary cited source (CBC) could not be fetched directly due to access restrictions.
   citedwww.cbc.ca/news/world/canadian-alleged-c…y-hack-9.7066147
2. #24[unverifiable][awaiting moderator]in section: Technical Root Cause: Tick Manipulation and Liquidity Double-Counting

   “CertiK and multiple other auditing firms had previously reviewed the KyberSwap Elastic code without identifying this specific vulnerability.”

   reviewerCertiK and multiple other auditing firms had previously reviewed KyberSwap Elastic code without identifying this specific vulnerabilityThe URL itself is live and topically relevant; the specific claim that named audit firms reviewed this exact code without catching the bug could not be independently confirmed or refuted.
   citedwww.certik.com/resources/blog/3f9rJpDr4k…yberswap-elastic

A cited source no longer resolves or no longer says what the page attributes to it.

1. #20[link rot][awaiting moderator]in section: Fugitive Status and International Pursuit

   “https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit”

   reviewerCointelegraph source URL for the workforce-reduction claimThe cited Cointelegraph URL is dead with no working Wayback Machine snapshot. A live alternative covering the same fact was located and is proposed as a replacement.
   Proposed correction (not yet applied)

   https://cryptobriefing.com/kyber-network-cuts-50-staff-following-48-million-exploit/
   citedcointelegraph.com/news/kyber-network-cut…november-exploit
2. #21[link rot][awaiting moderator]in the cited sources

   “https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit”

   reviewersources_used entry for the same dead Cointelegraph URLSame dead URL as the section-level citation; grouped under the same defect.
   Proposed correction (not yet applied)

   https://cryptobriefing.com/kyber-network-cuts-50-staff-following-48-million-exploit/
   citedcointelegraph.com/news/kyber-network-cut…november-exploit

The cited evidence supports part of the claim but not all of it.

1. #5[partially supported][awaiting moderator]in section: November 2023 Elastic Exploit

   “draining approximately $48.8 million from 77 liquidity pools. An additional $6.6 million was extracted by front-running bots that detected the attack in progress, bringing the total to approximately $55.2 million.”

   reviewer77 pools drained, primary exploiter $48.8M, additional $6.6M by front-running bots, bringing total to approximately $55.2 millionComponent figures ($48.8M and $6.6M) are precisely correct, but the page's derived '$55.2 million' total undercounts relative to the source's own stated combined total of ~$56.2 million by omitting minor copycat-exploit amounts.
   citedblog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in the summary

   “On November 22, 2023, its Elastic liquidity pool contracts were exploited via a sophisticated tick-manipulation and liquidity double-counting attack, resulting in approximately $48.8 million in losses across 13 chains.”

   reviewerKyberSwap Elastic exploited November 22, 2023 for approximately $48.8 millionDate, dollar figure, and 13-chain count all verified against the official post-mortem and contemporaneous CoinDesk reporting.
   citedblog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/www.coindesk.com/tech/2023/11/23/kybersw…ses-negotiations
2. #2[confirmed][no action needed]in the summary

   “The alleged attacker, Canadian national Andean Medjedovic, subsequently attempted to extort full corporate and governance control of Kyber Network in exchange for returning 50% of stolen funds; he was indicted by the U.S. Department of Justice in February 2025 and remains a fugitive.”

   reviewerAndean Medjedovic offered to return 50% of stolen funds in exchange for full corporate/governance control, indicted Feb 2025, remains a fugitiveMatches DOJ release and multiple news accounts of the ransom demand.
   citedwww.justice.gov/opa/pr/canadian-man-char…-hacking-schemes
3. #3[confirmed][no action needed]in section: Overview and Platform Background

   “KyberSwap is a decentralized exchange (DEX) aggregator and automated market maker (AMM) protocol developed by Kyber Network, a Singapore-based blockchain company co-founded by Loi Luu, Victor Tran, and Yaron Velner.”

   reviewerKyberSwap developed by Kyber Network, Singapore-based, co-founded by Loi Luu, Victor Tran, Yaron Velner; operates across 17+ chainsFounder names and headquarters independently corroborated.
   citedblog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/
4. #4[confirmed][no action needed]in section: Overview and Platform Background

   “By 2025 the platform had processed over $100 billion in cumulative trading volume since inception.”

   reviewerBy 2025 KyberSwap had processed over $100 billion in cumulative trading volume since inceptionDirectly confirmed by the cited official recap post.
   citedblog.kyberswap.com/kyberswap-2025-recap-…mentum-at-scale/
5. #6[confirmed][no action needed]in section: November 2023 Elastic Exploit

   “The exploit affected deployments on Arbitrum ($20 million), Optimism ($15 million), Ethereum ($7 million), and several other chains including BSC, Avalanche, Polygon, Fantom, Base, Scroll, Linea, Polygon zkEVM, BitTorrent, and Cronos.”

   reviewer77-pool exploit affected Arbitrum ($20M), Optimism ($15M), Ethereum ($7M) and other named chainsVerified against both the official post-mortem's chain list and independent reporting on the per-chain dollar breakdown.
   citedblog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/
6. #7[confirmed][no action needed]in section: November 2023 Elastic Exploit

   “The primary attacker address identified is 0x50275E0B7261559cE1644014d4b78D4AA63BE836.”

   reviewerPrimary attacker address identified as 0x50275E0B7261559cE1644014d4b78D4AA63BE836Address matches public blockchain-explorer labels exactly (case-insensitive).
   citedblog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/
7. #8[confirmed][no action needed]in section: November 2023 Elastic Exploit

   “KyberSwap's TVL collapsed from approximately $80 million to $22.23 million immediately following the attack, a drop of over 72%.”

   reviewerKyberSwap TVL collapsed from approximately $80 million to $22.23 million immediately following the attack, a drop of over 72%Confirmed against the specific cited source; a differing TVL figure exists elsewhere but does not clearly supersede this one.
   citedwww.coindesk.com/tech/2023/11/23/kybersw…ses-negotiations
8. #9[confirmed][no action needed]in section: Technical Root Cause: Tick Manipulation and Liquidity Double-Counting

   “The attacker exploited this by using a flash loan of approximately 10,000 wstETH (worth roughly $23 million), executing a sequence of carefully calculated swaps and artificial position minting to drive prices into low-liquidity ranges, trigger the mismatch condition, and then extract far more tokens than were deposited.”

   reviewerRoot cause was a precision error in computeSwapStep()/updateLiquidityAndCrossTick causing liquidity double-counting; not a reentrancy attack; attacker used a ~10,000 wstETH (~$23M) flash loanTechnical mechanism is well corroborated across BlockSec, Halborn and independent reporting; consensus explicitly rejects the 'reentrancy' framing some lower-quality outlets used.
   citedblocksec.com/blog/kyberswap-incident-mas…tle-calculationswww.halborn.com/blog/post/explained-the-…ck-november-2023
9. #10[confirmed][no action needed]in section: Audit History and Prior Security Incidents

   “The DOJ subsequently characterized the settlement proposal as a 'sham' in its February 2025 indictment.”

   reviewerOn November 30, 2023 attacker posted ransom letter demanding executive/governance control with Dec 10 deadline; DOJ later called this a 'sham' settlement proposalVerified against the DOJ's own press release language.
   citedwww.coindesk.com/policy/2025/02/03/u-s-p…inance-kyberswap
10. #11[confirmed][no action needed]in section: Attacker Extortion Demands

    “The maximum combined penalty for all charges is 90 years imprisonment.”

    reviewerMaximum combined penalty for all charges is 90 years imprisonmentArithmetic independently verified against the DOJ's stated per-count maximums.
    citedwww.justice.gov/opa/pr/canadian-man-char…-hacking-schemes
11. #12[confirmed][no action needed]in section: Attacker Extortion Demands

    “charging him with five counts: wire fraud, unauthorized damage to a protected computer (Computer Fraud and Abuse Act), attempted Hobbs Act extortion, money laundering conspiracy, and money laundering.”

    reviewerFive counts: wire fraud, CFAA unauthorized damage, attempted Hobbs Act extortion, money laundering conspiracy, money laundering; investigated jointly by FBI, IRS-CI, HSI; $65M across two protocols ($16M Indexed Finance 2021, $48.8M KyberSwap 2023)Charge list and agencies confirmed; page's list of agencies is a subset of, not contradictory to, the DOJ's fuller list.
    citedwww.justice.gov/opa/pr/canadian-man-char…-hacking-schemes
12. #17[confirmed][no action needed]in section: DOJ Indictment of Alleged Attacker Andean Medjedovic

    “Separately, Medjedovic has reportedly hired Washington D.C. lobbyists at a reported cost of $300,000 to pursue a pardon.”

    reviewerMedjedovic has reportedly hired Washington D.C. lobbyists at a reported cost of $300,000 to pursue a pardonConfirmed via an independent CBC report naming the firm and dollar figure.
    citedbalkaninsight.com/2026/03/24/fugitive-ca…n-from-trump/bi/
13. #18[confirmed][no action needed]in section: Fugitive Status and International Pursuit

    “Approximately $5.17 million was recovered from two front-running bot operators who responded to a 10% bug bounty offer, and an additional $706,000 in locked assets was recovered.”

    reviewerKyber Network suspended liquidity additions and urged withdrawal; recovered $5.17 million from two front-running bot operators via 10% bug bounty, plus $706,000 in locked assetsPrecisely matches the official post-mortem's own recovery figures.
    citedblog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/
14. #19[confirmed][no action needed]in section: Fugitive Status and International Pursuit

    “On December 24, 2023, CEO Victor Tran announced a 50% workforce reduction across the company, citing the need to sustain operations after the financial losses.”

    reviewerOn December 24, 2023, CEO Victor Tran announced a 50% workforce reductionContent of the claim is independently corroborated by other outlets even though the specific cited URL is dead.
    citedcointelegraph.com/news/kyber-network-cut…november-exploit
15. #22[confirmed][no action needed]in section: Fugitive Status and International Pursuit

    “A Treasury Grant Program was announced in late December 2023 offering affected users either 60% of their losses in stablecoins over 3 months vesting, or 100% over 12 months vesting, with distributions beginning February 1, 2024. Total grant obligations approached $49 million, substantially exceeding the approximately $6 million recovered.”

    reviewerTreasury Grant Program offered 60% over 3 months or 100% over 12 months, distributions beginning February 1, 2024; total grant obligations approached $49 millionAll figures verified precisely against the official program announcement.
    citedblog.kyberswap.com/kyberswap-treasury-grant-program/
16. #23[confirmed][no action needed]in section: On-Chain Tracing of Stolen Funds

    “He has publicly acknowledged responsibility for that attack while previously denying involvement in the KyberSwap exploit.”

    reviewerMedjedovic executed Indexed Finance exploit October 2021, stealing ~$16 million; publicly acknowledged that attack while previously denying involvement in KyberSwapConsistent with CoinDesk's account of Medjedovic's own public statements.
    citedwww.coindesk.com/policy/2025/02/03/u-s-p…inance-kyberswap