TLDR

• 22-year-old Canadian Andean Medjedovic faces federal charges over $65M theft from two DeFi platforms
• The accused hacker targeted Indexed Finance in 2021 ($16M) and Kyberswap in 2023 ($50M)
• He allegedly attempted to extort Kyberswap developers after the hack, demanding platform control
• Despite claiming reformation as a whitehat hacker, prosecutors say he planned the second attack
• Currently a fugitive, Medjedovic has reportedly been moving through multiple countries since 2021

Federal prosecutors have unveiled charges against a young Canadian programmer accused of orchestrating two major cryptocurrency heists totaling $65 million, marking another chapter in the ongoing battle against digital asset theft.

Andean “Andy” Medjedovic, who began his alleged criminal activities as a teenager, now faces a five-count federal indictment for attacks on two decentralized finance platforms. The charges stem from the 2021 exploitation of Indexed Finance and a 2023 attack on Kyberswap.

Court documents reveal that Medjedovic first struck Indexed Finance when he was still in his teens, making off with $16 million in digital assets. Unlike many hackers who maintain anonymity, he openly admitted to this attack, arguing that exploiting vulnerabilities in the platform’s code wasn’t illegal.

The newly unsealed indictment, filed in the Eastern District of New York, details how Medjedovic allegedly spent months preparing for his second, larger attack. Investigators discovered notes he wrote to himself, including a reminder to “Find time to Strike!” and a detailed “POST-EXPLOITATION” strategy.

In November 2023, prosecutors say Medjedovic executed his plan against Kyberswap, successfully extracting approximately $50 million from the platform. Following the theft, he allegedly attempted to leverage his position by offering to return half the stolen funds in exchange for control over the platform and its governing organization.

Personal writings recovered during the investigation shed light on Medjedovic’s mindset. In one file, he analyzed his situation: “Going On the run / Yes / Chance of getting caught

The technical details of the attacks show a pattern of manipulating smart contracts, the automated programs that handle transactions on these platforms. By feeding false data into these systems, Medjedovic allegedly tricked them into processing withdrawals at artificial prices, draining millions in investor funds.

After the initial Indexed Finance incident, Medjedovic publicly claimed to have reformed, telling reporters he had become a “whitehat” hacker – someone who helps find and fix security vulnerabilities. However, prosecutors allege that just eight months after making these claims, he was already planning the Kyberswap attack.

To hide the stolen cryptocurrency, authorities say Medjedovic employed sophisticated laundering techniques. These included using digital asset swaps, moving funds between different blockchain networks through “bridging transactions,” and utilizing cryptocurrency “mixers” designed to obscure the money trail.

The charges against Medjedovic include wire fraud, unauthorized damage to a protected computer, attempted Hobbs Act extortion, money laundering conspiracy, and money laundering. Each charge carries substantial prison time, with maximum sentences ranging from 10 to 20 years.

Since December 2021, Medjedovic has been evading capture. In a 2023 interview, he described his life on the run as “exhausting,” revealing that he had been moving between locations in Europe, South America, and an unnamed island nation to avoid arrest.

U.S. Attorney John J. Durham characterized the attacks as “highly sophisticated,” noting how the scheme exploited complex technological vulnerabilities to steal tens of millions in cryptocurrency from investors.

The investigation has involved extensive international cooperation, with assistance from the Netherlands’ Public Prosecution Service and Cybercrime Unit, along with U.S. Customs and Border Protection. However, Medjedovic remains at large, with authorities confirming he is not believed to be in the United States.

His case draws parallels to that of another DeFi hacker, Avraham “Avi” Eisenberg, who took a similar “code is law” stance after stealing $110 million from Mango Markets. Eisenberg’s recent conviction on fraud charges may foreshadow the legal system’s view of Medjedovic’s actions.

Law enforcement agencies continue their international manhunt for Medjedovic, while federal prosecutors prepare their case. A spokesperson for the Eastern District of New York confirmed that locating the fugitive remains a priority for multiple agencies.

15