Verify a decision

{"actor":"system:backfill","investigation_id":"30c321e3-34ee-4e69-a4dc-f853a48f15bc","kind":"publish","page_slug":"kyberswap-elastic","published_at":"2026-05-20T15:41:06.296Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"KyberSwap Elastic","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://www.chainsecurity.com/security-audit/kyberswap-elastic"},{"credibility":3,"name":"","type":"other","url":"https://docs.kyberswap.com/reference/legacy/audits"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1"},{"credibility":3,"name":"","type":"other","url":"https://blocksec.com/blog/kyberswap-incident-masterful-exploitation-of-rounding-errors-with-exceedingly-subtle-calculations"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023"},{"credibility":3,"name":"","type":"other","url":"https://rekt.news/kyberswap-rekt"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2023/11/24/kyberswap-offers-10-bounty-to-attacker-who-made-off-with-50m"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/kyberswap-dex-exploiter-bounty-negotiation-message-on-chain"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/kyberswap-hacker-bridges-stolen-funds"},{"credibility":3,"name":"","type":"other","url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/265429/kyber-hacker-control-message"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/kyberswap-hacker-demands-complete-control-over-kyber-company"},{"credibility":3,"name":"","type":"other","url":"https://bitcoinist.com/kyberswap-compensate-victims-deadline-gets-closer/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit"},{"credibility":3,"name":"","type":"other","url":"https://crypto.news/kyberswap-laid-off-50-of-workforce-after-54m-elastic-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap"},{"credibility":3,"name":"","type":"other","url":"https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/andean-medjedovic-kyberswap-alleged-hacker"},{"credibility":3,"name":"","type":"other","url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023"},{"credibility":3,"name":"","type":"other","url":"https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi"},{"credibility":3,"name":"","type":"other","url":"https://blog.kyberswap.com/post-mortem-past-kyberswap-frontend-exploit-sept-2022/"},{"credibility":3,"name":"","type":"other","url":"https://blocksec.com/blog/yet-another-tragedy-of-precision-loss-an-in-depth-analysis-of-the-kyber-swap-incident-1"}]}],"sources_used":[],"summary":"KyberSwap Elastic is the concentrated liquidity automated market maker (AMM) component of Kyber Network, a decentralized exchange protocol deployed across more than a dozen EVM-compatible blockchains. On November 22–23, 2023, it suffered the largest DeFi exploit of that year — approximately $48–56 million drained via a precision rounding bug in its tick-crossing swap logic — after which the alleged attacker issued an on-chain ultimatum demanding full executive control of the company. Canadian national Andean Medjedovic was indicted by U.S. prosecutors in February 2025 on charges including wire fraud, computer hacking, and extortion; he remains a fugitive as of mid-2026.","timeline":[{"date":"2021-12-01","event":"KyberSwap Elastic concentrated liquidity protocol launches.","source":""},{"date":"2022-09-01","event":"KyberSwap suffers a separate frontend exploit; no user funds reported lost from smart contracts.","source":""},{"date":"2023-05-01","event":"Hardened KyberSwap Elastic contracts re-deployed following a vulnerability disclosure and ChainSecurity audit; no funds lost during upgrade.","source":""},{"date":"2023-11-22","event":"Exploit begins; attacker drains approximately $48–56 million from KyberSwap Elastic pools across Arbitrum, Optimism, Ethereum, Polygon, Base, and Avalanche using a flash loan and precision rounding bug.","source":""},{"date":"2023-11-23","event":"KyberNetwork confirms the security incident. Liquidity additions suspended across all Elastic pools. Attacker posts on-chain message: 'Negotiations will start in a few hours when I am fully rested.'","source":""},{"date":"2023-11-24","event":"KyberSwap offers the attacker a 10% bounty (~$4.6M) in exchange for return of 90% of stolen funds.","source":""},{"date":"2023-11-29","event":"Attacker posts on-chain warning against legal threats, escalating the standoff.","source":""},{"date":"2023-11-30","event":"Attacker publishes extended on-chain ultimatum demanding full executive and DAO control of Kyber Network, setting a December 10 deadline.","source":""},{"date":"2023-12-02","event":"KyberSwap announces Treasury Grant Program to compensate victims, declining to meet the attacker's demands.","source":""},{"date":"2023-12-10","event":"Attacker's deadline passes; no resolution. Funds are not returned.","source":""},{"date":"2023-12-20","event":"KyberSwap Treasury Grant Program opens; offers 60% (3-month vesting) or 100% (12-month vesting) compensation in USD stablecoins to approximately 2,367 affected liquidity providers.","source":""},{"date":"2023-12-24","event":"Kyber Network CEO Victor Tran announces 50% workforce reduction. Liquidity protocol and KyberAI paused.","source":""},{"date":"2024-01-01","event":"Andean Medjedovic, a Canadian national, is held in Belgrade, Serbia for approximately 105 days following an Interpol Red Notice, but is released after a Serbian court declines to extradite him.","source":""},{"date":"2025-02-03","event":"U.S. DOJ unseals indictment against Canadian national Andean Medjedovic, 22, charging him with wire fraud, computer hacking, attempted extortion, and money laundering for alleged $65M in hacks of KyberSwap and Indexed Finance. Medjedovic remains a fugitive.","source":""}]},"v":1}