A 22-year-old Canadian crypto hacker who allegedly defrauded two DeFi protocols of $65 million has vanished from custody after being arrested in Serbia.
Andean Medjedovic, a Hamilton native with a master’s degree in pure mathematics earned at age 18, now faces charges in multiple jurisdictions, with his whereabouts remaining unknown.
This week, a criminal indictment was unsealed against Andean Medjedovic, a Canadian national who allegedly manipulated two decentralized finance protocols to obtain about $65 million in illicit funds from the protocols’ investors. https://t.co/peirBeNDJ3 pic.twitter.com/YHkoGmq9vk
— FBI (@FBI) February 5, 2025
Medjedovic’s four-year evasion ended with his August 2024 arrest in Belgrade, only for him to slip away again from authorities pursuing extradition.
Math Genius Turned Criminal: The $65M Double Heist
Medjedovic’s alleged crimes began in October 2021 when he manipulated Indexed Finance’s index pools using borrowed cryptocurrencies, draining over $16.5 million from investors.
The following year, he conspired with an unnamed accomplice to launder the stolen funds through fraudulent exchange accounts and crypto mixers.
His most brazen heist occurred in November 2023, when he allegedly exploited KyberSwap’s code to artificially manipulate prices in the protocol’s liquidity pools.
“Medjedovic then calculated precise combinations of trades that would cause the KyberSwap AMM to ‘glitch,’ in his words, allowing him to steal tens of millions of dollars in cryptocurrency from the liquidity pools,” the United States Attorney’s Office states.
The Vietnam-based platform lost $48.8 million in the attack.
Shortly after the heist, the attacker sent a public message: “Negotiations will start in a few hours when I am fully rested. Thank you.”
KyberSwap offered a standard 10 percent bug bounty, but Medjedovic rejected it outright. Instead, he demanded complete control of the Kyber platform and offered to return just 50 percent to investors.
The KyberSwap team has been in contact with the owners of the frontrun bots that extracted about $5.7M* worth of funds from KyberSwap pools on Polygon and Avalanche during the exploit.
We have negotiated with the owners of the frontrun bots to return 90% of the users’ funds taken…— Kyber Network (@KyberNetwork) November 26, 2023
According to CBC reports, Dutch authorities traced the hack to a hotel in The Hague, where Medjedovic allegedly checked in using a fake Slovak passport.
Two weeks after his flight departed Amsterdam for Kuwait via Istanbul in late November 2023, Dutch authorities issued a European arrest warrant, followed by an Interpol Red Notice.
Court documents reveal Medjedovic spent those intervening years traveling extensively.
He visited Brazil, Dubai, Spain, Bosnia, and Serbia while attempting to maintain his lavish lifestyle on stolen crypto.
Arrested in Belgrade, Then Vanished — Where Is He Now?
Medjedovic’s run ended on August 9, 2024, when he arrived in Belgrade using the alias “Lorenzo” to book an apartment. Interpol Belgrade immediately contacted Dutch authorities upon his arrest.
During extradition proceedings at the Belgrade Higher Court, Medjedovic denied all accusations. “I do not wish to go to the Netherlands,” he stated, adding that “I would like to have children in Serbia and to achieve some more things here.”
He claimed he had been in Dubai for 4 months and had visited the Netherlands for 3 months “on a tourist trip.” Despite being Canadian, Medjedovic told the court he holds only a Bosnian passport.
The U.S. indictment revealed Medjedovic maintained detailed files documenting his schemes, including one titled “moneyMovementSystem” with step-by-step instructions for laundering cryptocurrency through mixers.
He allegedly wrote notes to “make a new bank account under a fake ID” and “order documents online (Russian + Brazilian + American citizen).”
His Next Move: Return the Funds or Rot in Prison
As of publication, Medjedovic has disappeared from Serbian custody, and the stolen $65 million remains dormant in crypto wallets.
“He needs to be perfect from here until eternity in obfuscating the proceeds of this exploit, which are being tracked,” said Kyle Armstrong, a former FBI agent at blockchain intelligence firm TRM Labs.
Ari Redbord, TRM’s global head of policy, noted that modern digital tracking makes prolonged evasion increasingly difficult.
“Everything is tracking to the overall growth of the crypto ecosystem,” says Ari Redbord (@ARedbord) of @trmlabs, telling @RemyBlaireNews as he discusses rising illicit crypto volumes and why they remain a small share of total activity. pic.twitter.com/09Z0UcRElK
— FINTECH.TV (@FintechTvGlobal) January 16, 2026
“The reality is that at some point you come in and you fall on your sword and potentially do everything you can to ultimately help the government,” he said.
If Medjedovic refuses to cooperate by returning funds and taking responsibility, he could face more than 10 years in prison.
The post Canadian Hacker Steals $65M, Disappears From Custody — What Happened? appeared first on Cryptonews.
