Information disclosed on January 30 indicates that 21-year-old Canadian national Andean Medjedovic is accused of obtaining approximately USD 65 million in digital assets through multiple DeFi attacks, involving Indexed Finance and KyberSwap. Investigations are being jointly advanced by law enforcement agencies across multiple jurisdictions.
Details of the Indexed Finance and KyberSwap Attacks
According to investigative records, Medjedovic leveraged his mathematical and programming expertise as early as age 18 to exploit mechanism-level vulnerabilities in Indexed Finance, illegally profiting approximately USD 16.5 million.
Subsequently, in 2023, he allegedly carried out an attack on KyberSwap by manipulating liquidity conditions and smart contract execution logic, resulting in losses of approximately USD 48 million.
Cross-Border Flight and Extradition Obstacles
Law enforcement records show that Medjedovic was arrested in Belgrade, Serbia, in August 2024, but a Serbian court later rejected an extradition request from the Netherlands, leading to his release. Current intelligence suggests he may be hiding in Bosnia.
To evade tracking, he reportedly used a forged Slovak passport and moved across multiple jurisdictions, including Brazil, Dubai, and Spain, significantly complicating international enforcement cooperation.
On-Chain Laundering Routes Draw Regulatory Scrutiny
The U.S. Department of Justice alleges that the stolen funds were laundered through mixing services such as Tornado Cash, in an attempt to sever traceability between the source and destination of assets. Such methods enable rapid fragmentation, cross-chain transfers, and reaggregation of funds, substantially raising investigative complexity.
Nevertheless, the immutability of on-chain data continues to provide critical evidence, with interaction patterns among multiple addresses serving as key leads in advancing the case.
Suspect Denies Charges as Enforcement Challenges Persist
In prior court statements, Medjedovic denied all allegations, claiming that he continues to earn approximately USD 100,000 per month as a “crypto freelancer.” Multiple international arrest warrants remain active, and the case’s trajectory now depends on further judicial coordination across borders.
DeFi Risk Governance Enters a New Phase
This incident underscores how DeFi attacks have evolved beyond isolated technical exploits, becoming compound risks involving cross-chain flows, mixer-based laundering, and multi-jurisdictional legal challenges. For platforms and compliance teams, reliance on post-incident asset freezes alone is increasingly insufficient.
In practice, some institutions have begun deploying address behavior profiling, fund flow correlation, and high-risk interaction detection to identify anomalous accounts earlier. These capabilities align closely with the core use cases of Trustformer KYT, which supports risk assessment before funds reach critical circulation points.
Long-Term Implications for the Industry
Analysts note that as attackers grow younger, more technically capable, and increasingly mobile across borders, DeFi security incidents will continue to shape regulatory stances and institutional participation. Over the long term, the sustainable development of the crypto market may depend more heavily on on-chain transparency, risk identification capabilities, and the efficiency of international cooperation.