KyberSwap
Summary
KyberSwap is a multi-chain decentralized exchange aggregator and concentrated liquidity protocol operated by Kyber Network. On November 22, 2023, its Elastic liquidity pool contracts were exploited via a sophisticated tick-manipulation and liquidity double-counting attack, resulting in approximately $48.8 million in losses across 13 chains. The alleged attacker, Canadian national Andean Medjedovic, subsequently attempted to extort full corporate and governance control of Kyber Network in exchange for returning 50% of stolen funds; he was indicted by the U.S. Department of Justice in February 2025 and remains a fugitive.
Connected Entities
1 entities · 10 linked investigations- + 6 more
Timeline(17 events)
2021-10-01
Indexed Finance DeFi protocol exploited for approximately $16 million. Andean Medjedovic later publicly acknowledged responsibility.
2021-12-01
Canadian court issues arrest warrant for Andean Medjedovic in connection with the Indexed Finance exploit. Medjedovic does not appear and becomes a fugitive.
2023-11-22
KyberSwap Elastic pools exploited via tick-manipulation and liquidity double-counting attack. Approximately $48.8 million drained from 77 pools across 13 chains. TVL drops from ~$80M to ~$22M.
2023-11-22
Kyber Network issues emergency advisory urging all users to withdraw funds from KyberSwap Elastic.
2023-11-23
Attacker posts on-chain message: 'negotiations will start in a few hours when I am fully rested,' taunting victims and referencing Ontario, Canada.
2023-11-30
Attacker, styling themselves 'Kyber Director,' posts on-chain ransom letter demanding complete executive and governance control of Kyber Network in exchange for returning 50% of stolen funds. December 10 deadline set.
2023-12-01
Netherlands issues a European arrest warrant for Andean Medjedovic in connection with the KyberSwap exploit. Dutch extradition documents allege the attack was carried out from a hotel in The Hague using a fake Slovak passport.
2023-12-10
Attacker's stated deadline for Kyber Network to comply with control demands passes without agreement.
2023-12-20
KyberSwap launches Treasury Grant Program offering affected users 60% immediate or 100% long-term stablecoin compensation for unrecovered losses.
2023-12-24
Kyber Network CEO Victor Tran announces 50% workforce reduction to sustain operations following the exploit.
2024-01-19
Treasury Grant Program UI opens for affected user registration and option selection.
2024-02-01
KyberSwap Treasury Grant vesting begins for eligible users.
2024-09-01
Andean Medjedovic arrested in Belgrade, Serbia, approximately nine months after the Dutch arrest warrant was issued.
2025-01-17
After 105 days in Serbian custody, Belgrade Higher Court denies Dutch extradition request. Medjedovic released and subsequently reported to be at large in Bosnia per DOJ filing.
2025-02-03
U.S. Department of Justice (EDNY) unseals federal indictment against Andean Medjedovic charging five counts including wire fraud, CFAA violations, Hobbs Act extortion, and money laundering conspiracy, covering $65 million across KyberSwap and Indexed Finance.
2026-01-30
Reports confirm Medjedovic has resurfaced in Bosnia after escaping Serbian custody. Interpol Red Notice remains active.
2026-03-24
Reports indicate Medjedovic has hired Washington D.C. lobbyists at a reported cost of $300,000 to pursue a presidential pardon.
Decision Log
- hash: CyjLUXoH3jFcxRSSSDXMcZ9EYRDtAhfJYA1hCbfckehJ
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/30/2026, 6:25:24 PM
last updated: 5/30/2026, 6:25:30 PM
avoid.net — verified advice for a post-truth world