Canadian Hacker Steals $65M, Disappears from Custody — What Actually Happened?

Canadian Hacker Steals $65M, Disappears From Custody

A 22-year-old Canadian hacker is on the run after allegedly stealing $65 million in a high-profile crypto fraud, evading authorities following his arrest in Serbia.

Andean Medjedovic, who hails from Hamilton and holds a master’s degree in pure mathematics obtained at just 18 years old, is now facing charges in several jurisdictions, and his current location remains a mystery.

Medjedovic's evasion came to an end in August 2024 when he was apprehended in Belgrade, but he quickly managed to disappear once again while authorities sought his extradition.

Key Points

Andean Medjedovic, a Canadian hacker, allegedly stole $65 million from two DeFi protocols.
His criminal activities began in October 2021 with Indexed Finance.
A major heist occurred in November 2023, involving KyberSwap, resulting in a loss of $48.8 million.
Despite his arrest in Belgrade, Medjedovic vanished again from custody.
Authorities are tracking the stolen funds, and he faces significant prison time if caught.

Math Prodigy Turns to Crime: The $65 Million Double Heist

Medjedovic's alleged criminal activities began in October 2021, when he exploited vulnerabilities in Indexed Finance’s index pools, siphoning off more than $16.5 million from unwitting investors.

In 2022, he reportedly teamed up with an unnamed accomplice to launder the illicit funds through fraudulent exchange accounts and crypto mixers.

His boldest crime occurred in November 2023 when he is said to have manipulated the KyberSwap protocol's code.

“Medjedovic then calculated precise combinations of trades that would cause the KyberSwap AMM to ‘glitch,’ allowing him to steal tens of millions of dollars in cryptocurrency from the liquidity pools,” stated the United States Attorney’s Office.

Canadian Hacker Steals $65M - TRM Labs' Chart

The attack led to a staggering $48.8 million loss for KyberSwap.

Following the heist, the hacker sent out a public message: “Negotiations will start in a few hours when I am fully rested. Thank you.”

KyberSwap offered a 10 percent bug bounty, but Medjedovic dismissed the offer, instead seeking complete control of the platform and proposing to return only half of the stolen funds.

Reports from CBC indicate that Dutch officials traced him to a hotel in The Hague, where he allegedly registered under a fake Slovak passport.

About two weeks after departing from Amsterdam to Kuwait via Istanbul in late November 2023, Dutch authorities issued a European arrest warrant and subsequently an Interpol Red Notice.

Court documents reveal that during this time, Medjedovic traveled extensively, visiting countries like Brazil, Dubai, Spain, Bosnia, and Serbia, all while trying to sustain his extravagant lifestyle funded by stolen cryptocurrency.

Arrested in Belgrade, Only to Disappear Again — What’s Next?

Medjedovic's run came to a halt on August 9, 2024, when he arrived in Belgrade, using the alias “Lorenzo” to rent an apartment. Once in custody, Interpol in Belgrade immediately contacted Dutch authorities.

During the extradition process at the Belgrade Higher Court, Medjedovic denied all allegations, stating, “I do not wish to go to the Netherlands,” and mentioned his desire to settle down and have a family in Serbia.

Claiming he had spent four months in Dubai and a three-month visit to the Netherlands just for tourism, he insisted that he only holds a Bosnian passport, despite being Canadian.

Canadian Hacker Steals $65M - Fake Passport Image

The U.S. indictment revealed that Medjedovic kept meticulous records of his illicit activities, including a document titled "moneyMovementSystem" that detailed how to launder cryptocurrency using mixers.

He allegedly had strategies ready to “create a new bank account under a fake ID” and “order documents online (Russian + Brazilian + American citizen)."

What’s Next: Will He Return the Funds or Serve Time?

As of now, Medjedovic has managed to evade authorities once more, and the $65 million remains in frozen crypto wallets.

“To stay hidden, he must be flawless in covering his tracks, as the stolen assets are being closely monitored,” commented Kyle Armstrong, a former FBI agent now with TRM Labs.

Ari Redbord, who leads global policy at TRM, pointed out that with modern digital tracking, it becomes increasingly challenging for criminals to evade capture for long.

“Eventually, you will have to face the music, and it may be in your best interest to return the funds and cooperate with authorities,” he advised.

Should Medjedovic refuse to relinquish the stolen assets and take accountability, he could be looking at a prison sentence exceeding ten years.