A wallet tied to one of crypto’s most notorious hackers is laundering funds again

A wallet belonging to Andean Medjedovic, the hacker allegedly behind the Indexed Finance and Kyberswap exploits, is active again after a year-long hiatus.

On Wednesday, the wallet sent some $13.5 million worth of Ether tokens to Tornado Cash, a popular tool for laundering stolen crypto, onchain records show.

It’s not clear if Medjedovic himself is behind the transactions. The hacker has previously been accused of conspiring with another person to move stolen funds.

“It’s concerning to see a threat actor act with such confidence after exploiting multiple victims,” Specter, a pseudonymous blockchain investigator who has tracked Medjedovic’s onchain activity, said.

“Hopefully, he is apprehended and held accountable.”

Between 2021 and 2023, Medjedovic allegedly stole approximately $65 million by exploiting code bugs in two decentralised finance protocols: Indexed Finance and Kyberswap.

In February last year, Medjedovic was charged with wire fraud, computer hacking and attempted extortion by the US Department of Justice in connection with the two hacks.

Yet Medjedovic claims he’s innocent. He doesn’t deny his involvement, but argues that his actions were legitimate trades that exploited how the protocols’ code was written. This view is often referred to as “code is law” by industry insiders.

The recent activity brings the total amount of money laundered from Medjedovic’s hacks to almost $25 million.

Who is Andean Medjedovic?

Medjedovic, a Canadian national, is regarded as a former maths prodigy, having graduated high school at age 14.

He enrolled at the University of Waterloo, the same university attended by Ethereum co-founder Vitalik Buterin. He completed an undergraduate degree in pure mathematics in three years compared to the usual four, and went on to complete a master’s degree in just one year.

Shortly after graduating, Medjedovic was identified in connection with the $16 million Indexed Finance hack in October 2021 through a seemingly trivial digital breadcrumb.

In a careless moment of vanity, he edited — under a user name associated with him — a Wikipedia page for a Canadian TV show he’d once appeared on and added himself to the list of show’s notable alumni as a “notable mathematician.”

Medjedovic had previously used that same user name to enter a competitive programming event, where he used wallets connected to those that hacked Indexed Finance. That was enough to connect the dots between his real identity and the heist. But it wasn’t enough to bring him to justice.

Medjedovic went on the run in December 2021 after a judge in Ontario issued an arrest warrant when he failed to show up for a court appearance.

On the run 

In early 2023, Medjedovic told DL News he was still on the run and living on an island which he declined to name. During conversations, he repeatedly steered the conversation towards his social views: He disparaged women and made numerous racist comments.

Medjedovic also claimed that he had switched over to being a “whitehat” — an ethical computer security expert who hacks into systems with permission to identify vulnerabilities, strengthen security, and prevent malicious attacks.

Yet months later, wallets tied to the Indexed Finance hack began receiving funds from those used in the $48 million Kyperswap hack, linking Medjedovic to the more recent theft as well.

The next time Medjedovic appeared in public records was when he was arrested in Serbia in 2024 on a warrant from the Netherlands, which accused him of being behind the two crypto hacks.

Medjedovic denied the charges and was released in November that year due to insufficient evidence.

The Belgrade Higher Court’s decision said that Dutch prosecutors had not sufficiently proven Medjedovic was the perpetrator of the hacks, and that even if he was, those crimes carried too light a sentence domestically to be worthy of extradition.

Presidential pardon?

On February 20, just over a year after the DoJ indictment, legal filings showed Medjedovic had retained lobbying and government relations firm JM Burkman & Associates with the goal of seeking a presidential pardon.

The filings show Medjedovic paid $300,000 up front for six months of services.

The lobbying firm said it plans to argue that Medjedovic’s case should be dismissed because similar conduct is usually left to regulators to evaluate, similar cases have been dismissed or resolved favorably in the past year, and because the case has little, if any, connection to the US.
In March last year, the US Securities and Exchanges Commission dismissed charges against BitClout founder Nader Al-Naji. In July 2024, Al-Naji was charged by the DoJ and the SEC for fraud and selling unregistered securities, with accusations that he misused $7 million in investor funds for personal luxury expenses.

In October, Roger Ver, an entrepreneur and Bitcoin investor, entered a deferred prosecution agreement with the DoJ. Ver paid the IRS nearly $50 million in back taxes, penalties, and interest stemming from his failure to properly report his Bitcoin holdings on tax returns. The government dismissed the indictment against him.

Additionally, at least seven more SEC enforcement actions involving crypto assets have been dismissed since Trump took office last year.

Tim Craig is DL News’ Edinburgh-based DeFi Correspondent. Reach out with tips at tim@dlnews.com.