The US Department of Justice has filed charges against an alleged crypto hacker, who it claims stole $65 million in cryptocurrency, starting when he was just 18 years old.
The now 22-year-old Andean Medjedovic faces five charges, linked to an indictment. The focus of these charges is for allegedly "stealing approximately $65 million in cryptocurrency from the KyberSwap and Indexed Finance decentralised finance (DeFi) protocols".
The first hack, in relation to Indexed Finance, involved a systemic vulnerability. Effectively, Indexed Finances managed to cut out many of the middle management fees from trades with built-in regulatory systems, and this reduced overhead partially led to its renown. However, that also appeared to be its fault.
Indexed Finance is monitored with a complex system of checks and balances by adjusting pool prices and liquidity (the cost and size of the digital market that users can purchase) for its crypto funds to incentivise or disincentive users from trading. As pointed out in Bloomberg's investigation of Indexed Finance in 2022, "This model assumed users would interact rationally with the protocol, buying low and selling high".
Medjedovic allegedly exploited this by loaning over $150 million in a 'flash loan' where he borrowed and gave back crypto assets in a single line of programmed transactions. This code would then purchase a vast supply of tokens immediately, artificiality pumping their value, where it would then swap that currency for a different one through an action known as "minting". In this same action, another flash loan would be taken to purchase a different token known as Sushi.
That Sushi token would find its way into the pool of currency, which would navigate around restrictions on the amount of tokens that can be introduced. Sushi would then be traded for the original tokens, which are now undervalued.
This process is claimed by the DoJ to have finished with Medjedovic burning and minting the supply of tokens to trade $4 million worth of Sushi tokens in $21 million worth of others. The loan is repaid, and he is being accused of cashing out $11.9 million for himself. Interestingly, a key part of this process is that the code gifted the Sushi tokens back to the pool, which isn't something a rational buyer would do, thus explaining how this system got around Indexed Finance's protocols.
After being offered 10% of the cryptocurrency by Indexed Finance, in exchange for Medjedovic handing the cryptocurrency back to them, he allegedly turned this down and instead taunted Indexed Finance's owners Laurence Day and Dillon Kellar, according to the above Bloomberg article.
In Laurence Day's reported email to Medjedovic back in 2021, Day implored him to give back the money, ending his email with "You can now choose what difficulty you want to play this game on. Easy mode or Dark Souls".
In a recent tweet recounting the email, Day says:
"It didn't have to be this way, but you wanted Dark Souls
:)"
I warned you in 2021, MedjedovicIt didn't have to be this way, but you wanted Dark Souls:) pic.twitter.com/lWMW1IHOGSFebruary 3, 2025
Medjedovic is alleged to have successfully completed this hack at just 18 years old. And how they were allegedly discovered is a papertrail of various accounts across the web. It starts with Day suspected a someone that had recently collaborated with the Indexed Finance and they had spoken to over Discord, under the username 'UmbralUpsilon'. Indexed Finance then linked the attacker's Ethereum wallet to another wallet filled with winnings earned in a recent hacking contest, also under the username 'UmbralUpsilon'. This connected to an email address, which was associated with a domain for a school board in Canada, which was similar to a Wikipedia account, which was similar to another on Github. A name added to a Wikipedia page for a Canadian quiz by this account gave them the name "Andean Medjedovic, notable mathematician."
It's claimed by Dan that the security work did not play a part in the hack itself.
Despite being on the run from the law since 2021, Medjedovic's alleged hacking of KyberSwap took place in 2023 and accounts for the rest of the $65 million he is accused of stealing.
Though this process is reportedly similar to that of the 2021 hack, the DoJ's press release claims that Medjedovic had figured out a complex system of trades to "glitch" the pool of tokens, making off with close to $50 million. It also alleges that he tried to launder and conceal the cryptocurrency through a sequence of asset swaps between blockchains.
Medjedovic has reportedly argued he had done nothing other than spot a "mispricing opportunity". He further argued via email to Bloomberg that he "did not steal anyone’s private keys" and "interacted with the smart contract according to its very own publicly available rules."
In emails reportedly sent to Bloomberg, Medjedovic argues that he took on risk in his system, and could suffer the results of that risk as other buyers and sellers do. He argues "The people who lost internet tokens in this trade were other people seeking to use the smart contract to their own advantage and taking on risky trading positions that they, apparently, did not fully understand.”
However, these charges are an elevation in proceedings nonetheless. Whether or not those charges will stick is reliant on a subsequent case.
Though there is a sticking point to any case: a second press release confirms "he is currently at large."
