Canadian Man Charged for $65 Million DeFi Hack Exploiting Vulnerabilities

KeyTakeaways:

Medjedovic is charged with exploiting vulnerabilities in KyberSwap and Indexed Finance.He allegedly laundered stolen funds using digital asset mixers and fake identities.Global law enforcement is pursuing Medjedovic, who remains at large despite the indictment.

Andean Medjedovic, a 22-year-old Canadian, is facing five criminal charges after being indicted for exploiting vulnerabilities in decentralized finance (DeFi) platforms between 2021 and 2023. Medjedovic allegedly manipulated smart contracts on decentralized exchange aggregators KyberSwap and Indexed Finance, siphoning off $65 million from investors. 

According to the U.S. Department of Justice, the charges include wire fraud, computer damage, extortion, and money laundering.

Medjedovic’s alleged scheme involved conducting swap transactions to exchange stolen tokens, bridging funds across multiple blockchains, and using digital asset mixers to obscure the flow of funds. 

Authorities state that Medjedovic used false identities to create accounts at several crypto exchanges, further concealing his activities. He also coordinated with associates to launder the proceeds of the Indexed Finance hack, employing fraudulent Know Your Customer (KYC) data.

Additionally, Medjedovic is accused of paying an undercover law enforcement agent $80,000 to bypass restrictions on a bridge protocol that froze several of his transactions. This transaction allowed him to unlock $500,000 in stolen cryptocurrency.

KyberSwap Exploit and Extortion Attempt

In November 2023, Medjedovic allegedly executed an exploit targeting KyberSwap, a prominent DeFi protocol on Ethereum and Arbitrum. By manipulating the protocol’s liquidity pools, he drained approximately $48.8 million across 77 pools. 

Following this exploit, Medjedovic attempted to extort KyberSwap developers, investors, and members of its decentralized autonomous organization (DAO) with a fraudulent settlement proposal.

Despite the indictment, Medjedovic remains at large. Law enforcement agencies, including the Netherlands’ Public Prosecution Service and the Dutch National Police Cybercrime Unit, are actively searching for him. If convicted, he faces up to 20 years in prison for each other charges, with a maximum sentence of 10 years for computer damage.

This indictment highlights a growing trend of cyber-enabled financial crimes within the crypto market as authorities worldwide intensify efforts to track and prosecute such activities.