Verify a decision

{"actor":"system:backfill","investigation_id":"334647a4-57cc-4458-86ba-a7e22c031e3e","kind":"publish","page_slug":"andean-medjedovic-kyberswap-indexed-finance-fugitive-active-laundering-2026","published_at":"2026-06-21T12:23:13.994Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Andean Medjedovic — KyberSwap/Indexed Finance Fugitive, Active Laundering 2026","sections":[{"content":"On February 3, 2025, the U.S. Attorney's Office for the Eastern District of New York unsealed a five-count federal indictment against Andean Medjedovic, 22, a Canadian national. The charges are: wire fraud, unauthorized damage to a protected computer (Computer Fraud and Abuse Act), attempted Hobbs Act extortion, money laundering conspiracy, and money laundering. The maximum combined sentence if convicted on all counts is 90 years in prison. Investigating agencies listed in the indictment include the IRS Criminal Investigation division, Homeland Security Investigations, the FBI New York Field Office, U.S. Customs and Border Protection, and the Dutch National Police. The indictment covers alleged criminal conduct spanning 2021 through at least late 2023.","heading":"Federal Indictment and Charges","severity":"critical","sources":[{"credibility":1,"name":"DOJ: Canadian Man Charged in $65M Cryptocurrency Hacking Schemes","type":"regulatory","url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes"},{"credibility":2,"name":"CoinDesk: U.S. Prosecutors Charge Canadian Man With $65M Hacks of Indexed Finance, KyberSwap","type":"news_article","url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap"},{"credibility":1,"name":"IRS Criminal Investigation J5 Media Release, February 10, 2025","type":"regulatory","url":"https://www.irs.gov/pub/irs-ci/j5-media-release-2-10-25.pdf"}]},{"content":"Prosecutors allege that in October 2021, Medjedovic executed a flash-loan-based oracle manipulation attack against Indexed Finance, a DeFi index protocol. By borrowing large sums of digital tokens and executing a sequence of deceptive trades, he allegedly triggered the protocol's 're-indexing' function in a manner that caused smart contracts to miscalculate asset prices. This allowed him to withdraw approximately $16.5 million in investor funds at artificial prices. Medjedovic has publicly admitted to being the Indexed Finance attacker, claiming at the time that his actions were permissible under a 'code is law' philosophy — i.e., that any operation executable within a smart contract's parameters constitutes lawful trading. A Canadian court issued a bench warrant for his arrest in December 2021 following the attack.","heading":"Indexed Finance Exploit (October 2021)","severity":"critical","sources":[{"credibility":1,"name":"DOJ: Canadian Man Charged in $65M Cryptocurrency Hacking Schemes","type":"regulatory","url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes"},{"credibility":2,"name":"DL News: Indexed Finance Hacker Charged in US for Alleged $65M Theft","type":"news_article","url":"https://www.dlnews.com/articles/defi/indexed-finance-hacker-charged-in-us-over-kyberswap-exploit/"},{"credibility":2,"name":"DL News: Indexed Finance Hacker Now Says He's a Whitehat","type":"news_article","url":"https://www.dlnews.com/articles/people-culture/andean-medjedovic-canadian-fugitive-hacker-code-is-law-whitehat/"}]},{"content":"The larger of the two alleged exploits targeted KyberSwap, a decentralized exchange protocol. Prosecutors allege Medjedovic planned the attack for months in advance, with evidence including personal notes reading 'Find time to Strike!' and a documented 'POST-EXPLOITATION' plan. He allegedly exploited a smart contract vulnerability in KyberSwap's automated market maker (AMM) by executing precise combinations of flash-loan-backed trades that caused the AMM to miscalculate key variables — effectively causing the protocol to 'glitch' — enabling him to drain approximately $48.8 million from 77 separate liquidity pools. The attack rendered victims' investments 'essentially worthless,' according to the DOJ. Following the exploit, Medjedovic allegedly attempted to extort KyberSwap's developers and investors through a 'sham settlement proposal' demanding complete control over both the KyberSwap company and its governance entity in exchange for returning 50% of the stolen funds.","heading":"KyberSwap Exploit (November 2023)","severity":"critical","sources":[{"credibility":1,"name":"DOJ: Canadian Man Charged in $65M Cryptocurrency Hacking Schemes","type":"regulatory","url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes"},{"credibility":2,"name":"CoinDesk: U.S. Prosecutors Charge Canadian Man With $65M Hacks of Indexed Finance, KyberSwap","type":"news_article","url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap"}]},{"content":"Medjedovic has been a fugitive since December 2021, when a Canadian court issued a bench warrant following the Indexed Finance attack. He has publicly stated he used fake names and fraudulent passports while traveling — records indicate he checked into a Dutch hotel under a fake Slovak passport bearing the name 'Luka Krajovic.' He later traveled through Europe, South America, and other jurisdictions. In 2023, he told a reporter that life on the run was 'exhausting.' On August 9, 2024, Serbian authorities arrested him in Belgrade after he arrived under an alias; he had been located using a Bosnian passport. He was held in Belgrade District Prison for 105 days. Belgrade's Higher Court rejected a Dutch extradition request, ruling that prosecutors had not sufficiently established grounds for suspicion and that the offenses as defined under Serbian law did not carry penalties sufficient to justify extradition. He was released from Serbian custody in November 2024. The U.S. DOJ noted in a January 17, 2025 filing that 'Defendant is believed to be at large in Bosnia.' An Interpol Red Notice has been issued. FBI, IRS Criminal Investigation, and Homeland Security Investigations remain actively involved in the manhunt.","heading":"Fugitive Status and International Evasion","severity":"critical","sources":[{"credibility":1,"name":"CBC News: Fake Passports, $65M US and an Interpol Red Notice","type":"news_article","url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"credibility":2,"name":"Balkan Insight: Canadian Crypto Fugitive Slips Dragnet in Serbia, Surfaces in Bosnia","type":"news_article","url":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/"},{"credibility":2,"name":"Yahoo News: Canadian Hacker Steals $65M, Disappears From Custody","type":"news_article","url":"https://www.yahoo.com/news/articles/canadian-hacker-steals-65m-disappears-120449985.html"}]},{"content":"On April 29, 2026, wallets attributed to Medjedovic by on-chain analysts and reported by DL News and Bitcoin.com News moved 2,900 ETH — approximately $6.8 million at the time — through Tornado Cash, a cryptocurrency mixer sanctioned by the U.S. Treasury Department's Office of Foreign Assets Control. The transactions involved repeated withdrawals of exactly 100 ETH to the Tornado Cash Router address, occurring within seconds or minutes of each other, a pattern consistent with structured laundering. This was reportedly the first significant wallet activity in approximately one year. Subsequent reporting by Bitget News indicated that wallets tied to Medjedovic had routed a cumulative total of approximately $24.88 million through Tornado Cash as of the time of publication. The same identified wallet cluster was reported to still hold more than $29 million in assets, including approximately 11,861 ETH and 796 wstETH. The DOJ indictment had previously alleged Medjedovic used 'swap transactions, bridge transactions, and digital asset mixers' to launder proceeds while opening exchange accounts with false identifying information.","heading":"Active Money Laundering — Tornado Cash Activity (April 2026)","severity":"critical","sources":[{"credibility":2,"name":"Bitcoin.com News: KyberSwap Exploiter Moves 2,900 ETH to Tornado Cash Two Years After $65M Heist","type":"on_chain","url":"https://news.bitcoin.com/kyberswap-exploiter-medjedovic-tornado-cash-2026/"},{"credibility":2,"name":"DL News: A Wallet Tied to One of Crypto's Most Notorious Hackers Is Laundering Funds Again","type":"on_chain","url":"https://www.dlnews.com/articles/people-culture/wallets-tied-to-andean-medjedovic-use-tornado-cash/"},{"credibility":2,"name":"Bitget News: Kyber Exploiter Launders $24.88M via Tornado Cash After Pardon Bid","type":"news_article","url":"https://www.bitget.com/news/detail/12560605392968"},{"credibility":2,"name":"CryptoTimes: Kyber Exploiter Actively Moves Stolen ETH via Tornado Cash","type":"news_article","url":"https://www.cryptotimes.io/2026/04/29/kyber-exploiter-actively-moves-stolen-eth-via-tornado-cash/"}]},{"content":"On February 20, 2026, Washington D.C. lobbying firm JM Burkman & Associates filed a Foreign Agents Registration Act (FARA) disclosure with the U.S. Department of Justice reporting a $300,000 retainer to seek a U.S. presidential pardon for Medjedovic. The filing was first reported publicly by Juno News and subsequently covered by CBC News and Balkan Insight. Jacob Wohl, a partner at the firm, described Medjedovic in media statements as 'a very brilliant young man' and argued the exploits constituted permissible trading activity rather than criminal conduct, echoing the 'code is law' defense. Wohl characterized the charges as better suited to civil rather than criminal court. The firm stated it had 'an understanding' with Medjedovic that none of the retainer funds were proceeds of the alleged hacks. On-chain analysts noted that wallet activity attributed to Medjedovic resumed approximately two months after the pardon filing.","heading":"Presidential Pardon Lobbying Effort","severity":"high","sources":[{"credibility":1,"name":"CBC News: Canadian Crypto Fugitive Is Seeking U.S. Presidential Pardon","type":"news_article","url":"https://www.cbc.ca/news/canada/andean-medjedovic-lobbyist-seeking-pardon-9.7130131"},{"credibility":2,"name":"Balkan Insight: Fugitive Canadian Hacker, Released by Serbia, Seeks Pardon from Trump","type":"news_article","url":"https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/"}]},{"content":"Andean Medjedovic is a Canadian national of Bosnian descent, born and raised in Hamilton, Ontario. He is widely described as a mathematics prodigy: he graduated high school at age 14 and enrolled at the University of Waterloo — the same institution attended by Ethereum co-founder Vitalik Buterin. He completed an undergraduate degree in pure mathematics in three years rather than the standard four, and completed a master's degree in pure mathematics in one year, receiving it at approximately age 18. The DOJ indictment alleges he applied this mathematical aptitude to identifying exploitable edge cases in DeFi smart contract arithmetic. His parents have Bosnian roots, and communications obtained by Canadian media showed him requesting his parents' Bosnian identification documents to pursue citizenship in an alternative jurisdiction. He has stated publicly that he has been on the run since 2021.","heading":"Background and Profile","severity":"medium","sources":[{"credibility":1,"name":"CBC News: Fake Passports, $65M US and an Interpol Red Notice","type":"news_article","url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"credibility":2,"name":"CoinDesk: U.S. Prosecutors Charge Canadian Man With $65M Hacks of Indexed Finance, KyberSwap","type":"news_article","url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap"},{"credibility":2,"name":"Bitdefender: DOJ Charges 22-Year-Old With Stealing $65 Million from DeFi Platforms","type":"news_article","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/doj-charges-22-year-old-with-stealing-65-million-from-defi-platforms"}]},{"content":"Medjedovic has publicly invoked the 'code is law' philosophy as a defense for both exploits, arguing that any trade executable within a smart contract's parameters constitutes permissible market activity rather than theft or fraud. This argument was rejected by a Canadian court at the time of the Indexed Finance arrest warrant. The DOJ indictment implicitly addresses this defense by characterizing the trades as 'deceptive' and noting that Medjedovic 'knew' the transactions would cause protocols to falsely calculate key variables. Legal analysts have drawn comparisons to the case of Avraham 'Avi' Eisenberg, who exploited Mango Markets for $110 million in 2022 using a similar 'code is law' justification; a New York jury rejected that defense and convicted Eisenberg of fraud and market manipulation. Eisenberg was sentenced to prison. The FARA-registered lobbying effort by JM Burkman & Associates pursues a parallel executive-branch pardon track rather than contesting the charges in court.","heading":"Legal Defense and 'Code Is Law' Argument","severity":"medium","sources":[{"credibility":2,"name":"CoinDesk: U.S. Prosecutors Charge Canadian Man With $65M Hacks of Indexed Finance, KyberSwap","type":"news_article","url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap"},{"credibility":2,"name":"Faegre Drinker: Takeaways from the Indictment of a Canadian National Allegedly Responsible for $65 Million DeFi Cryptocurrency Theft","type":"research","url":"https://www.faegredrinker.com/en/insights/publications/2025/2/oh-no-canada-takeaways-from-the-indictment-of-a-canadian-national-allegedly-responsible-for-65-million-defi-cryptocurrency-theft"},{"credibility":2,"name":"Blockworks: Code Is Law, Revisited","type":"news_article","url":"https://blockworks.com/news/code-is-law"}]}],"sources_used":[{"credibility":1,"name":"DOJ: Canadian Man Charged in $65M Cryptocurrency Hacking Schemes","type":"regulatory","url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes"},{"credibility":1,"name":"IRS Criminal Investigation J5 Media Release, February 10, 2025","type":"regulatory","url":"https://www.irs.gov/pub/irs-ci/j5-media-release-2-10-25.pdf"},{"credibility":1,"name":"CBC News: Fake Passports, $65M US and an Interpol Red Notice: Canadian Crypto Fugitive Vanishes After Arrest in Serbia","type":"news_article","url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"credibility":1,"name":"CBC News: Canadian Crypto Fugitive Is Seeking U.S. Presidential Pardon on Criminal Indictment","type":"news_article","url":"https://www.cbc.ca/news/canada/andean-medjedovic-lobbyist-seeking-pardon-9.7130131"},{"credibility":2,"name":"Balkan Insight: Canadian Crypto Fugitive Slips Dragnet in Serbia, Surfaces in Bosnia","type":"news_article","url":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/"},{"credibility":2,"name":"Balkan Insight: Fugitive Canadian Hacker, Released by Serbia, Seeks Pardon from Trump","type":"news_article","url":"https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/"},{"credibility":2,"name":"CoinDesk: U.S. Prosecutors Charge Canadian Man With $65M Hacks of Indexed Finance, KyberSwap","type":"news_article","url":"https://www.coindesk.com/policy/2025/02/03/u-s-prosecutors-charge-canadian-man-with-usd65m-hacks-of-indexed-finance-kyberswap"},{"credibility":2,"name":"DL News: A Wallet Tied to One of Crypto's Most Notorious Hackers Is Laundering Funds Again","type":"on_chain","url":"https://www.dlnews.com/articles/people-culture/wallets-tied-to-andean-medjedovic-use-tornado-cash/"},{"credibility":2,"name":"Bitcoin.com News: KyberSwap Exploiter Moves 2,900 ETH to Tornado Cash Two Years After $65M Heist","type":"on_chain","url":"https://news.bitcoin.com/kyberswap-exploiter-medjedovic-tornado-cash-2026/"},{"credibility":2,"name":"Bitget News: Kyber Exploiter Launders $24.88M via Tornado Cash After Pardon Bid","type":"news_article","url":"https://www.bitget.com/news/detail/12560605392968"},{"credibility":2,"name":"CryptoTimes: Kyber Exploiter Actively Moves Stolen ETH via Tornado Cash","type":"news_article","url":"https://www.cryptotimes.io/2026/04/29/kyber-exploiter-actively-moves-stolen-eth-via-tornado-cash/"},{"credibility":2,"name":"DL News: Indexed Finance Hacker Now Says He's a Whitehat","type":"news_article","url":"https://www.dlnews.com/articles/people-culture/andean-medjedovic-canadian-fugitive-hacker-code-is-law-whitehat/"},{"credibility":2,"name":"DL News: Indexed Finance Hacker Charged in US for Alleged $65M Theft","type":"news_article","url":"https://www.dlnews.com/articles/defi/indexed-finance-hacker-charged-in-us-over-kyberswap-exploit/"},{"credibility":2,"name":"Faegre Drinker: Takeaways from the Indictment of a Canadian National Allegedly Responsible for $65 Million DeFi Cryptocurrency Theft","type":"research","url":"https://www.faegredrinker.com/en/insights/publications/2025/2/oh-no-canada-takeaways-from-the-indictment-of-a-canadian-national-allegedly-responsible-for-65-million-defi-cryptocurrency-theft"},{"credibility":2,"name":"Bitdefender: DOJ Charges 22-Year-Old With Stealing $65 Million from DeFi Platforms","type":"news_article","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/doj-charges-22-year-old-with-stealing-65-million-from-defi-platforms"},{"credibility":2,"name":"Blockworks: Code Is Law, Revisited","type":"news_article","url":"https://blockworks.com/news/code-is-law"},{"credibility":2,"name":"Blockscope Research: The Legal Pursuit of Andean Medjedovic","type":"research","url":"https://research.blockscope.co/andean-medjovic-case-and-investigation"},{"credibility":2,"name":"CP24: Canadian Man Named in Alleged US$65-Million Crypto Scheme","type":"news_article","url":"https://www.cp24.com/news/2025/02/04/i-may-be-on-the-run-forever-now-canadian-man-named-in-alleged-us65-million-crypto-scheme/"}],"summary":"Andean 'Andy' Medjedovic is a Canadian national charged by the U.S. Department of Justice in February 2025 with five federal counts related to the alleged theft of approximately $65 million across two DeFi exploits: the 2021 Indexed Finance hack ($16.5M) and the 2023 KyberSwap exploit ($48.8M). He has been a fugitive since December 2021, evaded extradition after a Serbian court rejected a Dutch arrest warrant in late 2024, and as of April 2026 wallets attributed to him by law enforcement had routed approximately $24.88 million through Tornado Cash, with an estimated $29 million in exploit proceeds remaining in identified wallets.","timeline":[{"date":"2021-10-14","event":"Indexed Finance protocol exploited for approximately $16.5 million via alleged oracle manipulation using flash loans. Medjedovic later publicly admitted involvement.","source":"DOJ / CoinDesk","source_url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes"},{"date":"2021-12-01","event":"Ontario court issues bench warrant for Medjedovic's arrest following the Indexed Finance attack. Medjedovic leaves Canada and begins an extended period as a fugitive.","source":"CBC News","source_url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"date":"2023-11-22","event":"KyberSwap decentralized exchange exploited for approximately $48.8 million across 77 liquidity pools. Prosecutors allege months of prior planning.","source":"DOJ","source_url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes"},{"date":"2023-11-01","event":"Following the KyberSwap exploit, Medjedovic allegedly sends extortion demands to KyberSwap developers requesting full protocol governance control in exchange for returning 50% of stolen funds.","source":"DOJ","source_url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes"},{"date":"2023-12-11","event":"Dutch authorities issue a European arrest warrant for Medjedovic in connection with the KyberSwap hack.","source":"CBC News","source_url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"date":"2024-08-09","event":"Medjedovic arrested by Serbian authorities in Belgrade after arriving under an alias. Interpol Belgrade notified the same day.","source":"CBC News / Balkan Insight","source_url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"date":"2024-11-01","event":"Belgrade Higher Court rejects Netherlands extradition request after 105 days of detention. Court rules that evidence presented by Dutch prosecutors was insufficient to support suspicion of the alleged crimes and that Serbian law did not provide adequate sentencing provisions. Medjedovic is released from custody.","source":"Balkan Insight","source_url":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/"},{"date":"2025-01-17","event":"U.S. DOJ filing states 'Defendant is believed to be at large in Bosnia.'","source":"CBC News","source_url":"https://www.cbc.ca/news/world/canadian-alleged-cryptocurrency-hack-9.7066147"},{"date":"2025-02-03","event":"DOJ unseals five-count federal indictment against Medjedovic in the Eastern District of New York for the Indexed Finance and KyberSwap exploits totaling approximately $65 million.","source":"DOJ","source_url":"https://www.justice.gov/opa/pr/canadian-man-charged-65m-cryptocurrency-hacking-schemes"},{"date":"2026-01-30","event":"Balkan Insight publishes investigation confirming Medjedovic's presence in Bosnia and Herzegovina following his escape from Serbian custody.","source":"Balkan Insight","source_url":"https://balkaninsight.com/2026/01/30/canadian-crypto-fugitive-slips-dragnet-in-serbia-surfaces-in-bosnia/bi/"},{"date":"2026-02-20","event":"Washington D.C. lobbying firm JM Burkman & Associates files FARA disclosure with the DOJ reporting a $300,000 retainer to seek a U.S. presidential pardon for Medjedovic.","source":"CBC News","source_url":"https://www.cbc.ca/news/canada/andean-medjedovic-lobbyist-seeking-pardon-9.7130131"},{"date":"2026-03-24","event":"Balkan Insight reports on the pardon lobbying effort and confirms Medjedovic's continued fugitive status following Serbia's release.","source":"Balkan Insight","source_url":"https://balkaninsight.com/2026/03/24/fugitive-canadian-hacker-released-by-serbia-seeks-pardon-from-trump/bi/"},{"date":"2026-04-29","event":"Wallets attributed to Medjedovic route 2,900 ETH (approximately $6.8 million) through Tornado Cash in structured 100-ETH increments — the most significant on-chain activity in approximately one year. Cumulative Tornado Cash outflows from identified wallets reach approximately $24.88 million.","source":"DL News / Bitcoin.com News / Bitget News","source_url":"https://www.dlnews.com/articles/people-culture/wallets-tied-to-andean-medjedovic-use-tornado-cash/"}]},"v":1}