U.S. prosecutors charged 21 year old Canadian Andean Medjedovic with wire fraud, computer hacking, and attempted extortion tied to an estimated 65 million dollars taken from DeFi protocols. The case centers on two major exploits that hit Indexed Finance in 2021 for about 16.5 million dollars and KyberSwap in 2023 for about 48.5 million dollars, followed by an Interpol red notice.
Investigators say he used fake identities including a Slovak passport, moved funds through mixers such as Tornado Cash, and traveled through Brazil, Dubai, and Spain. Serbian authorities arrested him in Belgrade in August 2024, then released him after a Netherlands extradition request was denied. He is now believed to be hiding in Bosnia. The case tests cross border enforcement and DeFi security readiness.
The Alleged Heists and Charges
Two DeFi exploits in 2021 and 2023 now anchor a sprawling criminal case that spans continents, prosecutors, and on chain tracing. U.S. authorities allege Canadian national Andean Medjedovic executed precision attacks on Indexed Finance and KyberSwap, netting roughly 65 million dollars in crypto. The indictment frames the activity as wire fraud and computer intrusion rather than clever arbitrage, and adds attempted extortion and laundering counts tied to post exploit communications and fund movements. Investigators say the proceeds moved through mixers to obscure origin and ownership, turning a set of DeFi incidents into a global hunt.
Indexed Finance 2021 Exploit
Indexed Finance lost about 16.5 million dollars in October 2021 after an attacker manipulated pool dynamics to mint and redeem tokens at favorable prices. The attack, attributed by investigators to Medjedovic at age 18, combined math and programming to shift asset weights and extract value from index pools. The fallout consumed the community for months, with governance debates over liability, restitution, and the limits of code is law. Multiple recovery attempts and negotiations stalled as on chain evidence met jurisdictional and identity barriers, leaving many LPs with reduced holdings.
KyberSwap 2023 Exploit and Alleged Extortion
In November 2023, KyberSwap suffered a roughly 48.5 million dollar exploit that hit liquidity across several chains. After the drain, the attacker issued public demands, and U.S. prosecutors now tie those messages to an attempted extortion count. Taken together with the Indexed Finance incident, the alleged haul totals about 65 million dollars in digital assets, according to the charging documents and public reporting. The case treats the two exploits as part of a pattern rather than isolated bugs found and exploited in the wild.
U.S. Indictment and International Actions
The Eastern District of New York unsealed charges covering wire fraud, computer hacking, attempted extortion, and money laundering, elevating the incidents from protocol disputes to federal crimes. The Justice Department detailed a laundering path that routed funds through crypto mixers, including Tornado Cash, to break heuristics and hide movements across chains and services. Authorities coordinated with international partners and issued global notices as multiple countries sought to arrest the suspect. The charging narrative and the alleged laundering flow are laid out in the federal filings and related releases (Justice Department press release, CoinDesk, IRS CI).
Defense Position and Claimed Income
Medjedovic has denied the charges and stated he is innocent in court filings. He has told courts he earns about 100,000 dollars per month as a freelance crypto professional, income he says is unrelated to any alleged hacking. His counsel has framed the incidents as disputes over code behavior inside permissionless systems, not crimes. The defense is likely to challenge both attribution and intent, as well as the treatment of post exploit negotiations as extortion.
Life on the Run Fake Identities and Global Movements
The case also turned into a live test of modern fugitive tradecraft and border controls. Investigators and media reports describe a year marked by fake identities, multiple passports, and quick moves across jurisdictions. The picture that emerges from court records is a suspect who watched the on chain and legal heat rise and adapted while cashing out portions of the alleged proceeds. Viewed through travel logs, it reads like a manual in how identity fraud can extend the life of an international flight from arrest.
Fake Documents and Identities
Authorities and media accounts cite the use of fake names and multiple passports, including a fake Slovak passport, to cross borders and sidestep routine checks. The alleged identity changes served two goals: avoid detention on active warrants and keep access to financial services tied to new personas. Such document swapping reportedly enabled movement through airports that were primed to flag his legal name. Combined with crypto funded expenses, the approach reduced the friction from traditional banking controls.
Documented Travels and Lifestyle
Travel records and reporting point to movements through Brazil, Dubai, and Spain while under active pursuit, with stops that matched access to direct flights and crypto friendly service hubs. Accounts describe a high spend pattern funded by crypto assets, from premium accommodations to quick cash conversions in gray market venues. The spending was not only lifestyle but also operational, paying for new phones, SIMs, and services to keep location data dark. That pattern is consistent with cases where liquidity, speed, and anonymity take priority over efficiency.
- Reported itinerary highlights include Brazil for staging, Dubai for access to global flights and OTC desks, and Spain as an EU gateway during periods of intense scrutiny
- Spending focused on rapid mobility and identity rotation, often at a premium to avoid routine checks tied to real names
Evidence From Extradition Filings
Extradition materials at the Belgrade Higher Court detail movements, contacts, and seized documents during the period in Serbia. CBC’s Fifth Estate and the Balkan Investigative Reporting Network obtained and analyzed portions of those filings, including references to identity documents and travel companions. The filings help align reported travel with timestamps, border records, and devices, providing a partial map of the months before and after detention. While the records add texture, gaps remain where third country databases and private service logs are not yet public.
Arrest in Serbia Release and Uncertain Path
Serbia became the focal point when the international chase finally produced an arrest. What followed underscored how jurisdiction, extradition treaties, and case posture can shape outcomes as much as technical evidence. After months in custody, local rulings shifted the legal terrain and created a window for release. That opening may have been enough for him to exit before alignment across requests could be reached.
Arrest and Detention
Medjedovic was arrested in Belgrade in August 2024 in response to international warrants tied to the DeFi cases. He was held in a Serbian jail as prosecutors and foreign authorities prepared competing extradition requests. During detention, defense arguments focused on the nature of the charges and procedural issues around identification and seizure. The custody period also gave investigators time to track on chain movements and coordinate with external partners on asset tracing.
Extradition Rulings and Release
The Serbian court denied an extradition request from the Netherlands, a setback that reshaped the sequence of who could claim custody and when. Following that decision, he was released from custody and is believed to have crossed into Bosnia, according to reporting that cited regional law enforcement sources. His current location is unknown, and he has not resurfaced on public channels tied to his known identities. The release highlights the limits of fragmented extradition pipelines even when there is active multinational interest.
Implications for Web3 and Enforcement
This saga exposes the gaps that persist in cross border enforcement and extradition alignment for crypto native crime. It also reaffirms that incident response, on chain surveillance, and post exploit negotiation playbooks are not optional for protocols with meaningful TVL. Expect sustained pressure on mixers and exchange AML controls as agencies follow flows tied to the alleged proceeds and any new movements. For builders and investors, the security model must now integrate legal process, intelligence sharing, and liquidity risk in addition to audits.
- Protocol teams should maintain crisis runbooks that cover on chain triage, private investigator engagement, counsel, and negotiation guardrails
- Compliance teams at exchanges and OTC desks should expect sharper scrutiny of mixer linked flows, more targeted subpoenas, and faster cross border data requests
In the near term, protocols with similar pool mechanics should review oracle design, slippage parameters, and mint burn logic for attack surfaces. Over the long term, the case is likely to inform court views on where exploit behavior ends and computer fraud begins, and how negotiation demands are treated under extortion laws. The outcome will set practical guardrails for both exploiters and defenders, and it will influence how future cross border hunts for crypto suspects are coordinated.
Cross border crypto crime is maturing faster than the legal plumbing that pursues it. The U.S. case will proceed whether or not Medjedovic is in custody, while financial tracing and partner country cooperation continue behind the scenes. DeFi teams should treat this as a blueprint for attacker tradecraft and for the response that follows.
Expect more aggressive fund tracing, seizure attempts, and pressure on service providers that enable obfuscation. Protocols that invest in continuous monitoring, exploit containment, and recovery mechanisms will be better positioned when attackers test their defenses.
Key Takeaways
- Indictment alleges about 65 million dollars taken from Indexed Finance and KyberSwap.
- Interpol red notice and multi country pursuit underscore global stakes.
- Reports cite fake passports, travel through Brazil, Dubai, and Spain, and laundering via mixers.
- Arrest in Belgrade was followed by release after Serbia denied a Netherlands request.
- The case stresses incident readiness, AML rigor, and cooperative enforcement.
Related FAQs
What protocols were targeted and how much was taken
Indexed Finance lost about 16.5 million dollars in 2021 and KyberSwap lost about 48.5 million dollars in 2023 for a combined total near 65 million dollars.
What charges does the U.S. indictment include
The Eastern District of New York charged wire fraud, computer hacking, and attempted extortion tied to the DeFi exploits and alleged laundering.
Where is Andean Medjedovic now
After his release in Serbia, he is believed to be hiding in Bosnia based on reports from extradition proceedings and investigative outlets. His current status remains unconfirmed.
How should DeFi teams prepare for similar attacks
Prioritize continuous monitoring, rapid incident response, formal recovery playbooks, pre negotiated white hat channels, deep audits of economic and code risk, and rigorous AML coordination with exchanges and analytics firms.
