Canadian Accused of Stealing $65 Million from KyberSwap and Indexed Finance

U.S. authorities have charged Canadian Andean Medjedovic with fraud, hacking, attempted extortion, and money laundering in connection with the theft of approximately $65 million from DeFi projects KyberSwap and Indexed Finance.

In October 2021, the accused allegedly exploited a vulnerability in the rebalancing mechanism of Indexed Finance’s smart contract code, using “hundreds of millions of dollars” in borrowed assets. This reportedly allowed him to compromise the system for adding new tokens to the pool and set “artificial prices” on assets, resulting in the theft of about $16.5 million.

According to authorities, in the case of KyberSwap in November 2023, Medjedovic similarly used borrowed funds to manipulate prices in liquidity pools. He allegedly calculated combinations of trades that triggered a protocol failure. This enabled the hacker to steal $48.8 million from users across 77 pools on six blockchains.

The KyberSwap team offered the hacker 90% of the funds in exchange for a 10% reward. In response, the hacker demanded full control over the project and its funds in exchange for 50% of the proceeds.

He later attempted to launder the stolen money through cross-chain protocols and cryptomixers.

According to the U.S. Department of Justice, Medjedovic remains at large and is wanted.

Earlier in January, developers of the Ethereum client Geth fixed a vulnerability CVE-2025-24883, which allowed nodes to be stopped via DoS attacks through malicious P2P messages.