Canadian Hacker Indicted for $65M DeFi Heist

Canadian national Andean Medjedovic has been indicted on five counts by a U.S. federal grand jury, accused of stealing approximately $65 million worth of cryptocurrency from two decentralized finance (DeFi) protocols, KyberSwap and Indexed Finance. The charges include wire fraud, unauthorized damage to a protected computer, attempted Hobbs Act extortion, money laundering conspiracy, and money laundering.

According to court documents filed in the Eastern District of New York, Medjedovic, a 22-year-old Canadian hacker, manipulated smart contracts on both platforms between 2021 and 2023. The attacks resulted in the theft of approximately $16 million from Indexed Finance and $50 million from KyberSwap. If convicted, Medjedovic faces up to 90 years in prison, with individual counts carrying maximum sentences ranging from 10 to 20 years.

Prosecutors allege that Medjedovic used deceptive trading tactics to trick the protocols into calculating incorrect financial variables. This manipulation allowed him to withdraw large amounts of cryptocurrency at artificially generated prices, causing major losses for investors on both platforms. The investigation revealed that Medjedovic allegedly spent months planning the Kyberswap attack, with evidence including written notes to himself outlining a "POST-EXPLOITATION" plan and risk assessment.

Following the Kyberswap exploit in November 2023, authorities say Medjedovic attempted to extort the protocol’s developers. He offered to return only half of the stolen digital assets in exchange for full control of the Kyberswap platform and its governing decentralized autonomous organization (DAO). Unlike many cryptocurrency thieves who maintain anonymity, Medjedovic publicly admitted to being the Indexed Finance attacker, taking a "code is law" position similar to another DeFi hacker, Avraham Eisenberg.

Medjedovic has been evading authorities since December 2021, when a Canadian court issued a warrant for his arrest. In a 2023 interview, he described life as a fugitive as "exhausting" and revealed he had been moving between locations in Europe, South America, and an unnamed island nation. The case has involved international cooperation, with assistance from the Netherlands’ Public Prosecution Service and Cybercrime Unit, as well as U.S. Customs and Border Protection.