New York feds today unsealed a five-count criminal indictment charging a 22-year-old Canadian math prodigy with exploiting vulnerabilities in two decentralized finance protocols, allegedly using them to fraudulently siphon around $65 million from investors in the platforms.
Prosecutors allege Andean Medjedovic abused automated smart contracts used by the KyberSwap and Indexed Finance protocols to enrich himself. In the case of KyberSwap, where $48.4 million was drained from KyberSwap Elastic liquidity pools in November 2023, it is claimed that Medjedovic borrowed hundreds of millions of dollars in digital tokens, then ran several “deceptive trades” that he “knew would cause the protocols’ smart contracts to falsely calculate key variables” before transferring them to a wallet under his control.
Medjedovic allegedly called the exploit a “glitch” and “fake” liquidity. The feds also claim Medjedovic stole $16.5 million from two liquidity pools operated by the Indexed Finance protocol on the Ethereum blockchain platform in October 2021.
Medjedovic is additionally accused of trying to extort victims of the 2023 vulnerability exploit at KyberSwap, and of laundering the alleged assets through a series of transactions transferring them between more than one blockchain network, a process known as “bridging.” The indictment alleges that he “attempted to use several Layer 2 bridges to move approximately $42 million in fraudulently obtained crypto assets to the Ethereum blockchain.”
But prosecutors say that these funds could be traced to the KyberSwap exploit, and that “several of the bridges” then attempted to block the transactions. The indictment claims that while messaging “support channels” for those bridges seeking help in moving the transactions forward, Medjedovic offered the support channel for one bridge protocol “$50k in order to get my $100k unfrozen,” allegedly adding: “If not, I have no other options but to alert authorities.”
According to the indictment:
The indictment also claims Medjedovic prepared a “post-exploitation” plan for himself, which included, among other things, notes saying “KEEP the configs,” “Burn the evidence, including the histfile” and “*Book flight to: *Pack Bags,” as well as another file labeled “Decisions and Mistakes,” in which he allegedly wrote, “Going On the run / Yes / Chance of getting caught
