Indexed Finance

December 2020

Indexed Finance launches on Ethereum, introducing the NDX governance token and its first passively managed index pools.

February 2021

NDX token reaches all-time high of approximately $27.71.

September 2021

An individual later identified as Andean Medjedovic contacts the Indexed Finance team via Discord under the handle 'UmbralUpsilon,' asking specific technical questions allegedly while posing as an arbitrage bot developer.

14 October 2021

Flash loan exploit drains approximately $16 million from the DEFI5 ($11M) and CC10 ($5M) index pools. DEFI5 drops 85% and CC10 drops 98% within hours. The attack exploits a flaw in the pool's value approximation function during rebalancing.

15 October 2021

Indexed Finance publishes an initial post-mortem describing the vulnerability and proposes a fix. NDX falls approximately 35%.

17 October 2021

Core team members Laurence Day and Dillon Kellar identify the alleged attacker through off-chain digital forensics, tracing GitHub accounts, Discord usernames, and university records to Andean Medjedovic, an 18-year-old University of Waterloo applied mathematics student.

17 October 2021

Dillon Kellar contacts Medjedovic directly, stating he has been identified and will be reported to law enforcement unless funds are returned. Medjedovic allegedly replies 'LOL, good luck.' The team subsequently publishes a full public identification.

22 October 2021

CoinDesk publishes a detailed report on Medjedovic's refusal to return funds and his intent to test the 'code is law' argument in court.

27 October 2021

The Indexed Finance DAO begins voting on a victim compensation plan. Approved rates: 99.32% for direct token holders, 88.5% for LP token holders, funded via pool asset extraction and converted to DAI.

December 2021

A Canadian court issues an arrest warrant for Andean Medjedovic. He does not turn himself in and begins life as a fugitive.

19 May 2022

Bloomberg publishes an in-depth feature on the Indexed Finance hack and Medjedovic's refusal to return funds, noting hate symbols embedded in the attack code and address.

November 2023

Indexed Finance DAO faces two hostile governance takeover attempts targeting its approximately $120,000 treasury. Both are defeated; the second is resolved after co-founder Dillon Kellar pays the attacker $10,000 DAI to stand down. ZachXBT links the second attacker's wallet to an alleged DPRK IT worker.

November 2023

KyberSwap is exploited for approximately $49-50 million. U.S. prosecutors later allege Andean Medjedovic carried out this second attack as well.

3 February 2025

The U.S. Department of Justice unseals a five-count federal indictment in the Eastern District of New York charging Andean Medjedovic, age 22, with wire fraud, unauthorized damage to a protected computer, attempted Hobbs Act extortion, money laundering conspiracy, and money laundering in connection with $65 million in alleged thefts from Indexed Finance and KyberSwap. He faces a maximum of 90 years in prison. He remains at large.

30 January 2026

Balkan Insight reports that Medjedovic slipped a law enforcement dragnet in Serbia and was subsequently reported to be in Bosnia. He remains a fugitive.