{"id":20990,"date":"2026-01-30T14:27:21","date_gmt":"2026-01-30T14:27:21","guid":{"rendered":"https:\/\/bitunikey.com\/news\/andean-medjedovic-faces-make-or-break-manhunt-after-65m-defi-hacks\/"},"modified":"2026-01-30T14:27:25","modified_gmt":"2026-01-30T14:27:25","slug":"andean-medjedovic-faces-make-or-break-manhunt-after-65m-defi-hacks","status":"publish","type":"post","link":"https:\/\/bitunikey.com\/news\/andean-medjedovic-faces-make-or-break-manhunt-after-65m-defi-hacks\/","title":{"rendered":"Andean Medjedovic faces make-or-break manhunt after $65m DeFi hacks"},"content":{"rendered":"<p><\/p>\n<div class=\"post-detail__content blocks\">\n<p class=\"is-style-lead\">A 22-year-old Canadian accused of draining $65m from KyberSwap and Indexed Finance vanished from Serbian custody after a globe-spanning manhunt and stalled extradition.<\/p>\n<div id=\"cn-block-summary-block_1a7002a6c4dea7b9fd11eacd4eda1134\" class=\"cn-block-summary\">\n<div class=\"cn-block-summary__nav tabs\">\n        <span class=\"tabs__item is-selected\">Summary<\/span>\n    <\/div>\n<div class=\"cn-block-summary__content\">\n<ul class=\"wp-block-list\">\n<li>Prosecutors say Medjedovic used leveraged trades to drain ~$16.5m from Indexed Finance and later exploited KyberSwap for $48.8m.\u200b<\/li>\n<li>Authorities tracked his movements through Europe, the Middle East, and South America before arresting him in Belgrade under an alias.\u200b<\/li>\n<li>He has since disappeared from Serbian custody while $65m in crypto remains parked on-chain, monitored by blockchain intelligence firms.\u200b<\/li>\n<\/ul><\/div>\n<\/div>\n<p><!-- .cn-block-summary --><\/p>\n<p>A 22-year-old Canadian charged with defrauding two decentralized finance protocols of $65 million has disappeared from Serbian custody following his arrest, according to court documents unsealed this week.<\/p>\n<p>Andean Medjedovic, a Hamilton native who earned a master\u2019s degree in pure mathematics at age 18, faces charges in multiple jurisdictions. His current whereabouts remain unknown, according to authorities.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p>\n<p>The criminal indictment alleges Medjedovic manipulated two decentralized finance protocols to obtain approximately $65 million in funds from the protocols\u2019 investors.<\/p>\n<p>Medjedovic was arrested in Belgrade in August 2024, ending a four-year period of evasion, before escaping from custody while authorities pursued extradition proceedings.<\/p>\n<h2 class=\"wp-block-heading\">KyberSwap exploit hacker charged<\/h2>\n<p>According to the indictment, the alleged crimes began in October 2021 when Medjedovic manipulated Indexed Finance\u2019s index pools using borrowed cryptocurrencies, draining over $16.5 million from investors. The following year, he allegedly conspired with an unnamed accomplice to launder the stolen funds through fraudulent exchange accounts and cryptocurrency mixers.<\/p>\n<p>The most significant alleged theft occurred in November 2023, when Medjedovic reportedly exploited KyberSwap\u2019s code to artificially manipulate prices in the protocol\u2019s liquidity pools, according to the United States Attorney\u2019s Office.<\/p>\n<p>\u201cMedjedovic then calculated precise combinations of trades that would cause the KyberSwap AMM to \u2018glitch,\u2019 in his words, allowing him to steal tens of millions of dollars in cryptocurrency from the liquidity pools,\u201d the United States Attorney\u2019s Office stated.<\/p>\n<p>The Vietnam-based platform lost $48.8 million in the attack, according to company reports. Shortly after the incident, the attacker sent a public message stating: \u201cNegotiations will start in a few hours when I am fully rested. Thank you.\u201d<\/p>\n<p>KyberSwap offered a standard 10 percent bug bounty, which Medjedovic rejected, according to the indictment. He allegedly demanded complete control of the Kyber platform and offered to return 50 percent to investors. The <a rel=\"nofollow\" target=\"_blank\" href=\"https:\/\/learn.bybit.com\/en\/defi\/what-is-kyber-network-knc-crypto\" target=\"_blank\" rel=\"nofollow\">KyberSwap<\/a> team worked with owners of frontrun bots that extracted funds from KyberSwap pools on Polygon and Avalanche during the exploit to recover user funds, the company reported.<\/p>\n<p>Dutch authorities traced the hack to a hotel in The Hague, where Medjedovic allegedly checked in using a fake Slovak passport, according to court documents. Two weeks after his flight departed Amsterdam for Kuwait via Istanbul in late November 2023, Dutch authorities issued a European arrest warrant, followed by an Interpol Red Notice.<\/p>\n<p>Court documents reveal Medjedovic traveled to Brazil, Dubai, Spain, Bosnia, and Serbia during the intervening years.<\/p>\n<p>Medjedovic was arrested on August 9, 2024, when he arrived in Belgrade using the alias \u201cLorenzo\u201d to book an apartment, according to authorities. Interpol Belgrade immediately contacted Dutch authorities upon his arrest.<\/p>\n<p>During extradition proceedings at the Belgrade Higher Court, Medjedovic denied all accusations. \u201cI do not wish to go to the Netherlands,\u201d he stated, adding that \u201cI would like to have children in Serbia and to achieve some more things here.\u201d He claimed he had been in Dubai for four months and had visited the Netherlands for three months \u201con a tourist trip.\u201d Despite his Canadian nationality, Medjedovic told the court he holds only a Bosnian passport.<\/p>\n<p>The U.S. indictment revealed Medjedovic maintained detailed files documenting the alleged schemes, including one titled \u201cmoneyMovementSystem\u201d with step-by-step instructions for laundering cryptocurrency through mixers. He allegedly wrote notes to \u201cmake a new bank account under a fake ID\u201d and \u201corder documents online (Russian + Brazilian + American citizen).\u201d<\/p>\n<p>As of this publication, Medjedovic has disappeared from Serbian custody, and the stolen $65 million remains dormant in cryptocurrency wallets, according to blockchain tracking data.<\/p>\n<p>\u201cHe needs to be perfect from here until eternity in obfuscating the proceeds of this exploit, which are being tracked,\u201d said Kyle Armstrong, a former FBI agent at blockchain intelligence firm TRM Labs.<\/p>\n<p>Ari Redbord, TRM\u2019s global head of policy, noted that modern digital tracking makes prolonged evasion increasingly difficult. \u201cThe reality is that at some point you come in and you fall on your sword and potentially do everything you can to ultimately help the government,\u201d he said.<\/p>\n<p>If convicted and Medjedovic refuses to cooperate by returning funds and taking responsibility, he could face more than 10 years in prison, according to federal sentencing guidelines.<\/p>\n<p>    <!-- .cn-block-related-link --><\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>A 22-year-old Canadian accused of draining $65m from KyberSwap and Indexed Finance vanished from Serbian custody after a globe-spanning manhunt and stalled extradition. Summary Prosecutors say Medjedovic used leveraged trades&hellip;<\/p>\n","protected":false},"author":1,"featured_media":11452,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-20990","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cryptocurrency"],"_links":{"self":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/20990","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/comments?post=20990"}],"version-history":[{"count":1,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/20990\/revisions"}],"predecessor-version":[{"id":20991,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/posts\/20990\/revisions\/20991"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media\/11452"}],"wp:attachment":[{"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/media?parent=20990"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/categories?post=20990"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitunikey.com\/news\/wp-json\/wp\/v2\/tags?post=20990"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}