"Math Grad Mastermind Behind $65M Crypto Heist"

US authorities have indicted Canadian national Andean Medjedovic for his alleged role in the theft of $65 million in cryptocurrency from two decentralized finance (DeFi) protocols, KyberSwap and Indexed Finance. Medjedovic, a mathematics graduate from the University of Waterloo, faces charges of wire fraud, computer hacking, attempted extortion, and money laundering.

According to the indictment, Medjedovic exploited security vulnerabilities in the smart contracts maintained by KyberSwap and Indexed Finance to manipulate prices and drain funds from their liquidity pools. He allegedly stole $48.8 million from KyberSwap in 2023 and $16.5 million from Indexed Finance in 2021, leaving investors with effectively worthless investments.

Medjedovic meticulously planned the KyberSwap exploits over several months, maintaining a directory of files labeled with terms like "KYBER_KILL" and "templateexploit." He created a "POOL HIT LIST" to identify liquidity pools to target and timed the attack strategically, writing notes such as "Find time to Strike! CEO is in Ho-Chi." He even calculated the optimal time for the attack to coincide with when Americans and Europeans would likely be asleep.

After the attack, Medjedovic attempted to extort KyberSwap developers, investors, and DAO members by demanding control of the protocol in exchange for returning 50% of the stolen funds. He also worked to cover his tracks by laundering the stolen cryptocurrency through crypto mixers and blockchain bridges, shuffling the funds across multiple networks to obscure their origin. Medjedovic opened accounts at crypto exchanges using fake identities, attempting to liquidate his holdings without raising red flags.

When one bridge protocol froze his transactions, Medjedovic allegedly paid an undercover law enforcement agent $85,000, believing they were a developer who could bypass the restrictions and unlock $500,000 of his frozen crypto.

If convicted, Medjedovic faces significant penalties, including up to 20 years in prison for each count of wire fraud, attempted extortion, and money laundering, as well as 10 years for unauthorized damage to a protected computer. Law enforcement agencies, including the Dutch National Police Cybercrime Unit and U.S. prosecutors, continue to pursue Medjedovic, who