Andean Medjedovic faces make-or-break manhunt after $65m DeFi hacks

A 22-year-old Canadian accused of draining $65m from KyberSwap and Indexed Finance vanished from Serbian custody after a globe-spanning manhunt and stalled extradition.

A 22-year-old Canadian charged with defrauding two decentralized finance protocols of $65 million has disappeared from Serbian custody following his arrest, according to court documents unsealed this week.

Andean Medjedovic, a Hamilton native who earned a master’s degree in pure mathematics at age 18, faces charges in multiple jurisdictions. His current whereabouts remain unknown, according to authorities.

The criminal indictment alleges Medjedovic manipulated two decentralized finance protocols to obtain approximately $65 million in funds from the protocols’ investors.

Medjedovic was arrested in Belgrade in August 2024, ending a four-year period of evasion, before escaping from custody while authorities pursued extradition proceedings.

KyberSwap exploit hacker charged

According to the indictment, the alleged crimes began in October 2021 when Medjedovic manipulated Indexed Finance’s index pools using borrowed cryptocurrencies, draining over $16.5 million from investors. The following year, he allegedly conspired with an unnamed accomplice to launder the stolen funds through fraudulent exchange accounts and cryptocurrency mixers.

The most significant alleged theft occurred in November 2023, when Medjedovic reportedly exploited KyberSwap’s code to artificially manipulate prices in the protocol’s liquidity pools, according to the United States Attorney’s Office.

“Medjedovic then calculated precise combinations of trades that would cause the KyberSwap AMM to ‘glitch,’ in his words, allowing him to steal tens of millions of dollars in cryptocurrency from the liquidity pools,” the United States Attorney’s Office stated.

The Vietnam-based platform lost $48.8 million in the attack, according to company reports. Shortly after the incident, the attacker sent a public message stating: “Negotiations will start in a few hours when I am fully rested. Thank you.”

KyberSwap offered a standard 10 percent bug bounty, which Medjedovic rejected, according to the indictment. He allegedly demanded complete control of the Kyber platform and offered to return 50 percent to investors. The KyberSwap team worked with owners of frontrun bots that extracted funds from KyberSwap pools on Polygon and Avalanche during the exploit to recover user funds, the company reported.

Dutch authorities traced the hack to a hotel in The Hague, where Medjedovic allegedly checked in using a fake Slovak passport, according to court documents. Two weeks after his flight departed Amsterdam for Kuwait via Istanbul in late November 2023, Dutch authorities issued a European arrest warrant, followed by an Interpol Red Notice.

Court documents reveal Medjedovic traveled to Brazil, Dubai, Spain, Bosnia, and Serbia during the intervening years.

Medjedovic was arrested on August 9, 2024, when he arrived in Belgrade using the alias “Lorenzo” to book an apartment, according to authorities. Interpol Belgrade immediately contacted Dutch authorities upon his arrest.

During extradition proceedings at the Belgrade Higher Court, Medjedovic denied all accusations. “I do not wish to go to the Netherlands,” he stated, adding that “I would like to have children in Serbia and to achieve some more things here.” He claimed he had been in Dubai for four months and had visited the Netherlands for three months “on a tourist trip.” Despite his Canadian nationality, Medjedovic told the court he holds only a Bosnian passport.

The U.S. indictment revealed Medjedovic maintained detailed files documenting the alleged schemes, including one titled “moneyMovementSystem” with step-by-step instructions for laundering cryptocurrency through mixers. He allegedly wrote notes to “make a new bank account under a fake ID” and “order documents online (Russian + Brazilian + American citizen).”

As of this publication, Medjedovic has disappeared from Serbian custody, and the stolen $65 million remains dormant in cryptocurrency wallets, according to blockchain tracking data.

“He needs to be perfect from here until eternity in obfuscating the proceeds of this exploit, which are being tracked,” said Kyle Armstrong, a former FBI agent at blockchain intelligence firm TRM Labs.

Ari Redbord, TRM’s global head of policy, noted that modern digital tracking makes prolonged evasion increasingly difficult. “The reality is that at some point you come in and you fall on your sword and potentially do everything you can to ultimately help the government,” he said.

If convicted and Medjedovic refuses to cooperate by returning funds and taking responsibility, he could face more than 10 years in prison, according to federal sentencing guidelines.