Verify a decision

{"actor":"system:backfill","investigation_id":"498c6cce-b440-47b8-b117-f20dc3bd6c66","kind":"publish","page_slug":"indexed-finance","published_at":"2026-05-21T17:13:04.086Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Indexed Finance","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptobriefing.com/defi-protocol-indexed-finance-suffers-16m-exploit/","type":"other","url":""},{"credibility":3,"name":"https://ndxfi.medium.com/introducing-indexed-finance-ndx-5d91137bde29","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/indexed-finance-thwarts-hijackers-set-to-compensate-2021-hack-victims","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://ndxfi.medium.com/indexed-attack-post-mortem-b006094f0bdc","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/defi-protocol-indexed-finance-suffers-16m-exploit/","type":"other","url":""},{"credibility":3,"name":"https://blocksecteam.medium.com/the-analysis-of-indexed-finance-security-incident-8a62b9799836","type":"other","url":""},{"credibility":3,"name":"https://www.vidma.io/blog/indexed-finance-a-16-million-hack-exposes-defi-vulnerabilities","type":"other","url":""},{"credibility":3,"name":"https://decrypt.co/83681/defi-protocol-indexed-finance-hacked-for-16-million-team-finds-hacker","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-this-teen-hacker-seems-intent-on-testing-code-is-law-in-the-courts","type":"other","url":""},{"credibility":3,"name":"https://cryptobriefing.com/inside-the-war-room-how-indexed-finance-traced-its-16m-hacker/","type":"other","url":""},{"credibility":3,"name":"https://decrypt.co/83681/defi-protocol-indexed-finance-hacked-for-16-million-team-finds-hacker","type":"other","url":""},{"credibility":3,"name":"https://news.bloomberglaw.com/tech-and-telecom-law/math-prodigy-whose-hack-upended-defi-wont-give-up-his-millions","type":"other","url":""},{"credibility":3,"name":"https://www.bloomberg.com/news/features/2022-05-19/crypto-platform-hack-rocks-blockchain-community","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","type":"other","url":""},{"credibility":3,"name":"https://coingeek.com/canadian-teen-faces-arrest-warrant-over-defi-hack-in-code-is-law-case/","type":"other","url":""},{"credibility":3,"name":"https://www.theglobeandmail.com/business/article-us-charge-alleged-hacker-in-us65-million-cryptocurrency-scheme/","type":"other","url":""},{"credibility":3,"name":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/","type":"other","url":""},{"credibility":3,"name":"https://content.govdelivery.com/attachments/USDOJOPA/2025/02/03/file_attachments/3152493/Medjedovic%20Indictment%20508.pdf","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://ndxfi.medium.com/indexed-attack-compensation-plan-f2228303507","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/indexed-finance-thwarts-hijackers-set-to-compensate-2021-hack-victims","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.newsbtc.com/news/defi/how-indexed-finance-foiled-two-treasury-hijack-attempts-details/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/indexed-finance-thwarts-hijackers-set-to-compensate-2021-hack-victims","type":"other","url":""},{"credibility":3,"name":"https://coinjournal.net/news/indexed-finance-identifies-attacker-behind-16-million-hack/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://ndxfi.medium.com/indexed-attack-post-mortem-b006094f0bdc","type":"other","url":""},{"credibility":3,"name":"https://blocksecteam.medium.com/the-analysis-of-indexed-finance-security-incident-8a62b9799836","type":"other","url":""},{"credibility":3,"name":"https://www.vidma.io/blog/indexed-finance-a-16-million-hack-exposes-defi-vulnerabilities","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cryptonews.net/news/defi/2243873/","type":"other","url":""},{"credibility":3,"name":"https://etherscan.io/token/0x86772b1409b61c639eaac9ba0acfbb6e238e5f83","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/indexed-finance-thwarts-hijackers-set-to-compensate-2021-hack-victims","type":"other","url":""}]}],"sources_used":[],"summary":"Indexed Finance was an Ethereum-based decentralized protocol offering passively managed index pools, launched in late 2020. On October 14, 2021, the protocol suffered a sophisticated $16 million flash loan exploit targeting its DEFI5 and CC10 pools, destroying most user funds. The alleged attacker, Canadian mathematics prodigy Andean Medjedovic, was later charged by U.S. prosecutors in February 2025 in connection with $65 million in combined DeFi thefts and remains a fugitive as of early 2026.","timeline":[{"date":"2020-12-01","event":"Indexed Finance launches on Ethereum, introducing the NDX governance token and its first passively managed index pools.","source":""},{"date":"2021-02-01","event":"NDX token reaches all-time high of approximately $27.71.","source":""},{"date":"2021-09-01","event":"An individual later identified as Andean Medjedovic contacts the Indexed Finance team via Discord under the handle 'UmbralUpsilon,' asking specific technical questions allegedly while posing as an arbitrage bot developer.","source":""},{"date":"2021-10-14","event":"Flash loan exploit drains approximately $16 million from the DEFI5 ($11M) and CC10 ($5M) index pools. DEFI5 drops 85% and CC10 drops 98% within hours. The attack exploits a flaw in the pool's value approximation function during rebalancing.","source":""},{"date":"2021-10-15","event":"Indexed Finance publishes an initial post-mortem describing the vulnerability and proposes a fix. NDX falls approximately 35%.","source":""},{"date":"2021-10-17","event":"Core team members Laurence Day and Dillon Kellar identify the alleged attacker through off-chain digital forensics, tracing GitHub accounts, Discord usernames, and university records to Andean Medjedovic, an 18-year-old University of Waterloo applied mathematics student.","source":""},{"date":"2021-10-17","event":"Dillon Kellar contacts Medjedovic directly, stating he has been identified and will be reported to law enforcement unless funds are returned. Medjedovic allegedly replies 'LOL, good luck.' The team subsequently publishes a full public identification.","source":""},{"date":"2021-10-22","event":"CoinDesk publishes a detailed report on Medjedovic's refusal to return funds and his intent to test the 'code is law' argument in court.","source":""},{"date":"2021-10-27","event":"The Indexed Finance DAO begins voting on a victim compensation plan. Approved rates: 99.32% for direct token holders, 88.5% for LP token holders, funded via pool asset extraction and converted to DAI.","source":""},{"date":"2021-12-01","event":"A Canadian court issues an arrest warrant for Andean Medjedovic. He does not turn himself in and begins life as a fugitive.","source":""},{"date":"2022-05-19","event":"Bloomberg publishes an in-depth feature on the Indexed Finance hack and Medjedovic's refusal to return funds, noting hate symbols embedded in the attack code and address.","source":""},{"date":"2023-11-01","event":"Indexed Finance DAO faces two hostile governance takeover attempts targeting its approximately $120,000 treasury. Both are defeated; the second is resolved after co-founder Dillon Kellar pays the attacker $10,000 DAI to stand down. ZachXBT links the second attacker's wallet to an alleged DPRK IT worker.","source":""},{"date":"2023-11-01","event":"KyberSwap is exploited for approximately $49-50 million. U.S. prosecutors later allege Andean Medjedovic carried out this second attack as well.","source":""},{"date":"2025-02-03","event":"The U.S. Department of Justice unseals a five-count federal indictment in the Eastern District of New York charging Andean Medjedovic, age 22, with wire fraud, unauthorized damage to a protected computer, attempted Hobbs Act extortion, money laundering conspiracy, and money laundering in connection with $65 million in alleged thefts from Indexed Finance and KyberSwap. He faces a maximum of 90 years in prison. He remains at large.","source":""},{"date":"2026-01-30","event":"Balkan Insight reports that Medjedovic slipped a law enforcement dragnet in Serbia and was subsequently reported to be in Bosnia. He remains a fugitive.","source":""}]},"v":1}