Verify a decision

{"actor":"system:backfill","investigation_id":"49855de9-def0-4c67-a9cd-5fac17742b36","kind":"publish","page_slug":"kyberswap","published_at":"2026-05-30T18:25:30.220Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"KyberSwap","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","type":"other","url":""},{"credibility":3,"name":"https://blog.kyberswap.com/kyberswap-2025-recap-a-year-of-momentum-at-scale/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/tech/2023/11/23/kyberswap-dex-hacked-for-48-million-attacker-teases-negotiations","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","type":"other","url":""},{"credibility":3,"name":"https://blocksec.com/blog/kyberswap-incident-masterful-exploitation-of-rounding-errors-with-exceedingly-subtle-calculations","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023","type":"other","url":""},{"credibility":3,"name":"https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3305d3a","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter","type":"other","url":""},{"credibility":3,"name":"https://www.bankinfosecurity.com/cryptohack-roundup-kyberswap-hacker-demands-control-a-23733","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes","type":"other","url":""},{"credibility":3,"name":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","type":"other","url":""},{"credibility":3,"name":"https://hackread.com/canadian-charged-kyberswap-indexed-finance-defi-hack/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147","type":"other","url":""},{"credibility":3,"name":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/","type":"other","url":""},{"credibility":3,"name":"https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/","type":"other","url":""},{"credibility":3,"name":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit","type":"other","url":""},{"credibility":3,"name":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/kyberswap-laid-off-50-of-workforce-after-54m-elastic-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap","type":"other","url":""},{"credibility":3,"name":"https://www.certik.com/resources/blog/3f9rJpDr4kzqZsM2VwgiSA-kyberswap-elastic","type":"other","url":""}]}],"sources_used":[{"credibility":1,"name":"Post Mortem: KyberSwap Elastic Exploit November 2023 — KyberSwap Official Blog","type":"official","url":"https://blog.kyberswap.com/post-mortem-kyberswap-elastic-exploit/"},{"credibility":1,"name":"KyberSwap DEX Hacked for $48 Million, Attacker Teases Negotiations — CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2023/11/23/kyberswap-dex-hacked-for-48-million-attacker-teases-negotiations"},{"credibility":2,"name":"KyberSwap Hacker Demands Company Control in Unhinged On-Chain Ransom Letter — Decrypt","type":"news_article","url":"https://decrypt.co/208147/kyberswap-hacker-demands-company-control-unhinged-on-chain-ransom-letter"},{"credibility":1,"name":"KyberSwap hacker demands full control in bizarre on-chain message — The Block","type":"news_article","url":"https://www.theblock.co/post/265429/kyber-hacker-control-message"},{"credibility":1,"name":"Canadian Man Charged in $65M Cryptocurrency Hacking Schemes — DOJ Office of Public Affairs","type":"regulatory","url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes"},{"credibility":1,"name":"Canadian National Charged With Stealing Approximately $65 Million — DOJ EDNY","type":"court_filing","url":"https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi"},{"credibility":1,"name":"U.S. Prosecutors Charge Canadian Man With $65M Hacks of Indexed Finance, KyberSwap — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap"},{"credibility":1,"name":"Fake passports, $65M US and an Interpol Red Notice: Canadian crypto fugitive vanishes after arrest in Serbia — CBC News","type":"news_article","url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"credibility":2,"name":"Canadian Crypto Fugitive Slips Dragnet in Serbia, Surfaces in Bosnia — Balkan Insight","type":"news_article","url":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/"},{"credibility":2,"name":"Fugitive Canadian Hacker, Released by Serbia, Seeks Pardon from Trump — Balkan Insight","type":"news_article","url":"https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/"},{"credibility":2,"name":"KyberSwap Incident: Masterful Exploitation of Rounding Errors — BlockSec Blog","type":"research","url":"https://blocksec.com/blog/kyberswap-incident-masterful-exploitation-of-rounding-errors-with-exceedingly-subtle-calculations"},{"credibility":2,"name":"A Deep Dive Into the KyberSwap Hack — SlowMist (Medium)","type":"research","url":"https://slowmist.medium.com/a-deep-dive-into-the-kyberswap-hack-3e13f3305d3a"},{"credibility":2,"name":"Explained: The KyberSwap Hack November 2023 — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-kyberswap-hack-november-2023"},{"credibility":2,"name":"KyberSwap Elastic — CertiK Audit Resource","type":"research","url":"https://www.certik.com/resources/blog/3f9rJpDr4kzqZsM2VwgiSA-kyberswap-elastic"},{"credibility":2,"name":"Kyber Network Cuts 50% of Staff Following $48 Million Exploit — CoinTelegraph","type":"news_article","url":"https://cointelegraph.com/news/kyber-network-cuts-workforce-50-percent-following-november-exploit"},{"credibility":1,"name":"KyberSwap Treasury Grant Program — KyberSwap Official Blog","type":"official","url":"https://blog.kyberswap.com/kyberswap-treasury-grant-program/"},{"credibility":2,"name":"CryptoHack Roundup: KyberSwap Hacker Demands Control — BankInfoSecurity","type":"news_article","url":"https://www.bankinfosecurity.com/cryptohack-roundup-kyberswap-hacker-demands-control-a-23733"},{"credibility":1,"name":"KyberSwap 2025 Recap — KyberSwap Official Blog","type":"official","url":"https://blog.kyberswap.com/kyberswap-2025-recap-a-year-of-momentum-at-scale/"}],"summary":"KyberSwap is a multi-chain decentralized exchange aggregator and concentrated liquidity protocol operated by Kyber Network. On November 22, 2023, its Elastic liquidity pool contracts were exploited via a sophisticated tick-manipulation and liquidity double-counting attack, resulting in approximately $48.8 million in losses across 13 chains. The alleged attacker, Canadian national Andean Medjedovic, subsequently attempted to extort full corporate and governance control of Kyber Network in exchange for returning 50% of stolen funds; he was indicted by the U.S. Department of Justice in February 2025 and remains a fugitive.","timeline":[{"date":"2021-10-01","event":"Indexed Finance DeFi protocol exploited for approximately $16 million. Andean Medjedovic later publicly acknowledged responsibility.","source":""},{"date":"2021-12-01","event":"Canadian court issues arrest warrant for Andean Medjedovic in connection with the Indexed Finance exploit. Medjedovic does not appear and becomes a fugitive.","source":""},{"date":"2023-11-22","event":"KyberSwap Elastic pools exploited via tick-manipulation and liquidity double-counting attack. Approximately $48.8 million drained from 77 pools across 13 chains. TVL drops from ~$80M to ~$22M.","source":""},{"date":"2023-11-22","event":"Kyber Network issues emergency advisory urging all users to withdraw funds from KyberSwap Elastic.","source":""},{"date":"2023-11-23","event":"Attacker posts on-chain message: 'negotiations will start in a few hours when I am fully rested,' taunting victims and referencing Ontario, Canada.","source":""},{"date":"2023-11-30","event":"Attacker, styling themselves 'Kyber Director,' posts on-chain ransom letter demanding complete executive and governance control of Kyber Network in exchange for returning 50% of stolen funds. December 10 deadline set.","source":""},{"date":"2023-12-01","event":"Netherlands issues a European arrest warrant for Andean Medjedovic in connection with the KyberSwap exploit. Dutch extradition documents allege the attack was carried out from a hotel in The Hague using a fake Slovak passport.","source":""},{"date":"2023-12-10","event":"Attacker's stated deadline for Kyber Network to comply with control demands passes without agreement.","source":""},{"date":"2023-12-20","event":"KyberSwap launches Treasury Grant Program offering affected users 60% immediate or 100% long-term stablecoin compensation for unrecovered losses.","source":""},{"date":"2023-12-24","event":"Kyber Network CEO Victor Tran announces 50% workforce reduction to sustain operations following the exploit.","source":""},{"date":"2024-01-19","event":"Treasury Grant Program UI opens for affected user registration and option selection.","source":""},{"date":"2024-02-01","event":"KyberSwap Treasury Grant vesting begins for eligible users.","source":""},{"date":"2024-09-01","event":"Andean Medjedovic arrested in Belgrade, Serbia, approximately nine months after the Dutch arrest warrant was issued.","source":""},{"date":"2025-01-17","event":"After 105 days in Serbian custody, Belgrade Higher Court denies Dutch extradition request. Medjedovic released and subsequently reported to be at large in Bosnia per DOJ filing.","source":""},{"date":"2025-02-03","event":"U.S. Department of Justice (EDNY) unseals federal indictment against Andean Medjedovic charging five counts including wire fraud, CFAA violations, Hobbs Act extortion, and money laundering conspiracy, covering $65 million across KyberSwap and Indexed Finance.","source":""},{"date":"2026-01-30","event":"Reports confirm Medjedovic has resurfaced in Bosnia after escaping Serbian custody. Interpol Red Notice remains active.","source":""},{"date":"2026-03-24","event":"Reports indicate Medjedovic has hired Washington D.C. lobbyists at a reported cost of $300,000 to pursue a presidential pardon.","source":""}]},"v":1}