Canadian Hacker Steals $65 Million and Disappears From Police Custody in Serbia

TL;DR

• Andean Medjedovic is charged with stealing $65M by exploiting vulnerabilities in DeFi protocols Indexed Finance and KyberSwap.
• He vanished in Serbia after his arrest while facing extradition proceedings to the Netherlands.
• He exploited a “glitch” in KyberSwap’s code to manipulate prices and steal nearly $49 million.

Andean Medjedovic, a 22-year-old Canadian with a master’s degree in pure mathematics, vanished from Serbian authorities after his arrest in August 2024. The young man faces charges in multiple jurisdictions for allegedly defrauding two DeFi protocols of $65 million.

Authorities captured Medjedovic in Belgrade after four years of international pursuit. However, the accused managed to escape again while facing extradition proceedings. His current whereabouts remain unknown.

This week, a criminal indictment was unsealed against Andean Medjedovic, a Canadian national who allegedly manipulated two decentralized finance protocols to obtain about $65 million in illicit funds from the protocols’ investors. pic.twitter.com/YHkoGmq9vk

— FBI (@FBI) February 5, 2025

The first attack occurred in October 2021 when Medjedovic manipulated Indexed Finance’s index pools using borrowed cryptocurrencies. The operation drained more than $16.5 million from affected investors. A year later, he conspired with an unidentified accomplice to launder the funds through fraudulent exchange accounts and cryptocurrency mixers.

The Most Audacious Strike: $48.8 Million Stolen From KyberSwap

The largest attack was executed in November 2023 against KyberSwap, a Vietnam-based platform. Medjedovic exploited flaws in the protocol’s code to artificially manipulate prices in liquidity pools.

“Medjedovic calculated precise combinations of trades that would cause a ‘glitch’ in KyberSwap’s AMM, allowing him to steal tens of millions of dollars,” stated the United States Attorney’s Office. The attack extracted $48.8 million from the platform.

Hours after the theft, the attacker sent a public message: “Negotiations will start in a few hours when I am fully rested. Thank you.” KyberSwap offered a standard 10 percent bounty for reporting vulnerabilities, but Medjedovic rejected it. Instead, he demanded complete control of the Kyber platform and offered to return only 50 percent to investors.

Dutch authorities traced the hack to a hotel in The Hague, where Medjedovic checked in with a fake Slovak passport. Two weeks after his flight departed Amsterdam for Kuwait via Istanbul, authorities issued a European arrest warrant and an Interpol Red Notice.

Court documents reveal Medjedovic traveled extensively through Brazil, Dubai, Spain, Bosnia, and Serbia while attempting to maintain a lavish lifestyle with stolen cryptocurrencies. On August 9, 2024, authorities arrested him in Belgrade when he booked an apartment under the alias “Lorenzo.”

During extradition hearings, Medjedovic denied all accusations and stated: “I do not wish to go to the Netherlands. I would like to have children in Serbia.“

The stolen $65 million remains dormant in crypto wallets. If Medjedovic refuses to cooperate by returning the funds, he could face more than 10 years in prison.