Indexed Finance hacker charged in US for alleged $65m theft

US prosecutors charged 22-year-old Andean Medjedovic on Monday in connection with a pair of alleged hacks totaling $65 million.

Medjedovic previously admitted to exploiting about $16 million from DeFi protocol Indexed Finance in October 2021, according to court papers.

He was also believed to be the hacker behind the November 2023 exploit of KyberSwap, which cost the protocol and its users about $48 million in crypto. The hacker later sent about $2 million in crypto to a digital wallet believed to be controlled by Medjedovic.

Medjedovic is facing five charges, including fraud, money laundering, and extortion. He did not respond to multiple requests for comment on Monday.

A maths prodigy from Canada, Medjedovic has been on the run since the Indexed Finance exploit in 2021.

But he insists that the exploit was legal. He was merely taking advantage of a flaw in the protocol’s design, he said in an online back-and-forth with victims.

That code-is-law defence recently failed a test in US federal court when a Manhattan jury convicted rogue trader Avraham Eisenberg of defrauding Mango Markets, a Solana-based exchange Eisenberg had exploited using a technique similar to Medjedovic’s.

In an interview with DL News in 2023, Medjedovic said his life as a fugitive had taken him through Europe and Latin America to an island he declined to name.

While he dodged questions about the Indexed exploit, Medjedovic insisted he had turned to ethical hacking because it offered a “more sustainable mode of being.”

He also repeatedly steered the conversation towards his social views, making misogynist and racist comments.

Several months later, a hacker pulled off a complex heist that drained KyberSwap, an aggregator of decentralised exchanges, of some $48 million.

DL News confirmed that a wallet connected to the Kyber exploiter sent $2 million to a wallet associated with Medjedovic.

The hacker also demanded control of Kyber in exchange for a return of some of the funds.

Prosecutors allege Medjedovic was indeed the person who hacked KyberSwap. They have charged him with defrauding the aggregator and its liquidity providers and extorting its developers and members of KyberDAO.

They also allege Medjedovic tried to launder the proceeds of the Indexed and KyberSwap exploits using an unnamed crypto mixer.

In the wake of the Indexed Finance exploit, Medjedovic wrote another user, “I did something very cool but accidentally doxxed myself in the process. I may be on the run forever now,” according to the indictment. “Need some advice about becoming a pirate.”

The indictment also alleges Medjedovic maintained digital documents detailing his money laundering plans. One such document included a note to “order a thinkpad [laptop] for storing crypto + hacks,” according to the indictment.

In the wake of the KyberSwap exploit, Medjedovic attempted to move stolen crypto off of a layer 2 blockchain and onto Ethereum but was blocked by its developers, according to the indictment.

He wrote to its support team, demanding they allow the transaction to proceed, according to the indictment; otherwise, he would “alert authorities.”

“You want to alert authorities … that you hacked kyber and stole user funds..??” someone from the support team replied.

“Yes,” Medjedovic said, according to the indictment. “Committing a crime against someone who may or may not be a criminal is still a crime.”

Laurence Day, a co-founder of Indexed, said the potential arrest of Medjedovic would have little impact on the victims of the 2021 exploit.

That’s because Medjedovic stored the proceeds in a crypto wallet that was itself hacked.

“The vast majority of what he stole was stolen in turn,” Day told DL News.

“I can’t speak to how this would shake out in restitution down the line given he attacked multiple protocols, but to my mind this is at least a closing chapter in the Indexed story.”

Aleks Gilbert is DL News’ New York-based DeFi correspondent. You can contact him at aleks@dlnews.com.