- Trending
- Comments
- Latest
A Canadian man accused of stealing $65 million from two decentralized finance protocols has disappeared from Serbian custody months after his arrest in Belgrade, according to court records and law enforcement notices.
Andean Medjedovic, 22, vanished from detention while awaiting extradition to the Netherlands, where prosecutors have charged him with exploiting KyberSwap and Indexed Finance between 2021 and 2023.
Medjedovic’s story reads like a techno-thriller. A Hamilton, Ontario native, the Canadian hacker earned a master’s degree in pure mathematics by age 18. Prosecutors say he later weaponized that expertise against DeFi protocols, exploiting smart-contract logic with surgical precision.
According to U.S. court filings, the Canadian hacker’s alleged crime spree began in October 2021 with Indexed Finance. By manipulating index pool mechanics using borrowed crypto, he drained roughly $16.5 million from liquidity providers. Investigators allege he later worked with an unnamed accomplice to launder the funds through shell exchange accounts and crypto mixers.
The most damaging attack came two years later.
In November 2023, the Canadian hacker allegedly turned his attention to KyberSwap, a Vietnam-based DeFi liquidity protocol. U.S. prosecutors say he identified vulnerabilities in KyberSwap’s automated market maker (AMM), allowing him to manipulate prices inside liquidity pools.
“Medjedovic then calculated precise combinations of trades that would cause the KyberSwap AMM to ‘glitch,’” the U.S. Attorney’s Office stated, “allowing him to steal tens of millions of dollars in cryptocurrency.”
The exploit drained approximately $48.8 million, sending shockwaves through the DeFi sector. Shortly afterward, the attacker posted a public on-chain message: “Negotiations will start in a few hours when I am fully rested. Thank you.”
KyberSwap offered the standard 10% bug bounty, but the Canadian hacker rejected it. Instead, he demanded control of the platform and proposed returning only half the stolen funds — a move that hardened the response from regulators and law enforcement.
Investigators quickly followed the digital breadcrumbs. According to CBC reporting, Dutch authorities traced the KyberSwap exploit to a hotel in The Hague, where Medjedovic allegedly checked in using a forged Slovak passport.
Within weeks of his departure from Amsterdam — traveling to Kuwait via Istanbul — Dutch prosecutors issued a European arrest warrant. Interpol soon followed with a Red Notice, formally flagging the Canadian hacker as internationally wanted.
Court documents reveal Medjedovic spent years moving across jurisdictions, including Brazil, Spain, Bosnia, Dubai, and Serbia, while allegedly financing a luxury lifestyle with stolen crypto.
The Canadian hacker’s run appeared to end on August 9, 2024. Serbian authorities arrested him in Belgrade after he booked an apartment under the alias “Lorenzo.” Interpol Belgrade immediately notified Dutch officials, triggering extradition proceedings.
During a hearing at the Belgrade Higher Court, Medjedovic denied all allegations. “I do not wish to go to the Netherlands,” he told the court, adding that he hoped to “have children in Serbia and achieve some more things here.”
Despite being a Canadian citizen, the Canadian hacker claimed he held only a Bosnian passport. He also told the court he had been living in Dubai for four months and had visited the Netherlands purely as a tourist.
Then, quietly, he vanished.
As of publication, Serbian authorities have not publicly explained how the Canadian hacker disappeared from custody, nor confirmed whether an internal investigation is underway.
U.S. indictments paint a detailed picture of premeditation. Prosecutors say the Canadian hacker kept meticulous files documenting his laundering methods, including one labeled “moneyMovementSystem.”
The documents allegedly included instructions to “make a new bank account under a fake ID” and to “order documents online (Russian + Brazilian + American citizen).” Investigators say the files show intent not just to steal, but to disappear.
Despite the escape, blockchain analytics firms continue monitoring the wallets tied to the exploits. The stolen $65 million remains largely untouched on-chain.
Former FBI agent Kyle Armstrong, now with blockchain intelligence firm TRM Labs, said evasion has limits.
“He needs to be perfect from here until eternity in obfuscating the proceeds of this exploit, which are being tracked,” Armstrong said. “That’s an extremely difficult thing to do.”
Ari Redbord, TRM’s global head of policy, echoed the point. “The reality is that at some point you come in and you fall on your sword,” he said, noting that prolonged flight often worsens legal outcomes.
If apprehended and convicted, the Canadian hacker could face more than a decade in prison across multiple jurisdictions. Prosecutors have made clear that cooperation — including returning stolen funds — could materially
the case stands as a stark reminder: even mathematical brilliance offers little protection against modern blockchain forensics.
And for the global crypto industry, the disappearance of a Canadian hacker accused of one of DeFi’s largest exploits underscores a hard truth — code may be borderless, but accountability is catching up fast.
