Canadian Hacker Accused of Stealing $65 Million in Cryptocurrency and Attempting to Extort DeFi Protocol

• Canadian Hacker Steals $65 Million from DeFi Protocols
• Crimes include wire fraud and cryptocurrency laundering
• KyberSwap targeted by extortion following cyberattack

The United States Department of Justice recently announced formal charges against Andean Medjedovic, a 22-year-old Canadian, for his alleged involvement in one of the largest cryptocurrency thefts linked to decentralized finance (DeFi) protocols. Medjedovic is accused of orchestrating sophisticated cyberattacks against the KyberSwap and Indexed Finance platforms, resulting in an estimated loss of around US$65 million, equivalent to approximately R$377 million. The case highlights, once again, the vulnerabilities of DeFi systems and the challenges they face. by authorities to combat cybercrime in an increasingly complex digital environment.

According to the indictment, between 2021 and 2023, Medjedovic exploited flaws in the smart contracts of both protocols, using advanced market manipulation techniques known as “deceptive trading.” The goal was to induce miscalculations in crucial financial variables, which allowed the hacker to fraudulently withdraw funds, directly affecting the investments of users in different parts of the world. He took advantage of the automated nature of these contracts to distort the functioning of liquidity pools, which are essential to the DeFi ecosystem, turning legitimate operations into a trap for investors.

The hacker faces five felony charges, including wire fraud, unauthorized damage to a protected computer, attempted extortion and two money laundering charges. If found guilty on all counts, Medjedovic could face up to 90 years in prison. The U.S. Department of Justice noted that the maximum sentence for the crime of damaging a protected computer is 10 years, while each of the other charges could result in up to 20 years in prison.

In addition to the direct financial impact, the case drew attention due to the audacity of the accused, who, after the attack on KyberSwap, tried to extort the platform’s developers. Medjedovic allegedly demanded that he be named CEO of the project as a condition for returning part of the stolen funds. In one of the messages sent to the victims, he stated: “I know this is probably less than you wanted. However, it is also more than you deserve.” KyberSwap, in turn, tried to negotiate by offering 10% of the embezzled amount, as long as the rest was returned, but the agreement was never finalized.

Investigations revealed that Medjedovic used a series of tactics to hide the origin of the stolen crypto assets. He used mixers to make it difficult to track transactions, carried out cross-chain operations to move funds between different blockchains, and used false identities to open accounts on cryptocurrency exchanges. One of the most curious details of the case is that he kept meticulous records of his operations in files named “moneyMovementSystem,” where he detailed step-by-step strategies to launder the funds and avoid being tracked.

Despite his apparent skill at hiding his tracks, Medjedovic ended up making mistakes that led to his identification. In private messages exchanged after the Indexed Finance attack, he admitted to having exposed himself during the process. “I did something really cool, but I ended up exposing myself in the process. Maybe now I have to run away forever… I need advice on how to become a hacker,” he wrote in an ironic tone to a contact. In addition, he transferred part of the stolen cryptocurrency to addresses linked to him in previous attacks, which made it easier for authorities to investigate.

Currently at large, Medjedovic is the target of an international operation involving the Dutch Public Prosecutor’s Office and the Dutch National Police’s Cybercrime Unit, which are working with U.S. authorities to locate him and bring him to justice. The case highlights the increasing sophistication of cybercrimes involving cryptocurrencies and the importance of international cooperation to combat these illicit activities in a market that continues to evolve rapidly.