Introduction to the Charges
U.S. prosecutors have taken significant action against a Canadian man, Andean “Andy” Medjedovic, who is accused of orchestrating two high-profile hacks that resulted in the theft of a staggering $65 million in cryptocurrency. These incidents involved the decentralized finance (DeFi) platforms Indexed Finance and KyberSwap, with the exploits taking place in 2021 and 2023, respectively.
The Allegations Against Medjedovic
In a recently unsealed indictment from the Eastern District of New York (EDNY), authorities have detailed the extent of Medjedovic’s alleged criminal activities. At just 22 years old, he has reportedly been linked to the Indexed Finance hack, which resulted in a loss of $16 million when he was still in his teenage years. While his involvement in the KyberSwap exploit was previously undisclosed, prosecutors now assert he played a central role in that incident as well.
Public Admission and the “Code is Law” Defense
Medjedovic was relatively open about his actions regarding the Indexed Finance hack, believing that his activities were not illegal. This mindset mirrors that of another hacker, Avraham “Avi” Eisenberg, who justified his $110 million theft from Mango Markets by claiming the principle of “code is law.” However, a New York jury found Eisenberg guilty of fraud and market manipulation, leading to a potential 20-year prison sentence.
Life as a Fugitive
Since December 2021, when a Canadian court issued an arrest warrant, Medjedovic has evaded capture. In a 2023 interview with a DeFi Llama reporter, he described the challenges of living as a fugitive, stating that he traveled extensively across Europe, South America, and even to an undisclosed island nation. As of now, EDNY officials confirm that he remains at large and is not believed to be in the United States.
The KyberSwap Hack: Planning and Execution
Approximately eight months after claiming he had transitioned into a whitehat hacker role, Medjedovic allegedly executed a calculated attack on KyberSwap, resulting in a theft of around $50 million. The indictment reveals that he meticulously planned this hack for several months, even creating a motivational note to himself that read, “Find time to Strike!” Additionally, he devised a comprehensive “POST-EXPLOITATION” strategy to ensure the success of his operation.
Reflections on Risk and Consequences
In his personal notes, Medjedovic reflected on his life as a fugitive, grappling with the risks associated with his actions. He pondered, “Going On the run / Yes / Chance of getting caught < Payoff for not getting caught / (NA) / Risk is typically underpriced in the modern world.” This insight highlights his awareness of the precarious nature of his criminal endeavors.
Legal Charges and Potential Penalties
The charges against Medjedovic are severe, including one count of wire fraud, one count of unauthorized damage to a protected computer, one count of attempted Hobbs Act extortion, one count of conspiracy to commit money laundering, and one count of money laundering. If convicted on all counts, he faces a maximum penalty of 90 years in prison.
Conclusion
The case against Andean “Andy” Medjedovic underscores the growing scrutiny of cybercriminal activities in the cryptocurrency landscape. As investigations continue, this situation serves as a stark reminder of the significant legal consequences that can arise from engaging in illicit online activities.
