Police south of the border are searching for a 22-year-old Canadian with a master’s degree in mathematics who allegedly stole roughly US$65 million worth of cryptocurrency and then bragged about it on “various electronic communication services.”
In a 35-page indictment unsealed in Brooklyn on Monday by the U.S. Attorney’s Office, Eastern District of New York, the Department of Justice accuses Andean Medjedovic of executing the alleged fraud between 2021 and 2023 by “exploiting vulnerabilities” on two decentralized finance (DeFi) protocols, KyberSwap and Indexed Finance.
“Through his deceptive trades, Medjedovic was able to, and did, withdraw millions of dollars of investor funds from the protocols at artificial prices, rendering the victims’ investments essentially worthless,” the indictment read.
Medjedovic already held a master’s degree in mathematics from the University of Waterloo at the age of 19, according to Ontario court documents.
But the documents also suggest that he may have gone into hiding back in 2021.
He is now wanted on five charges, including wire fraud, computer hacking, attempted extortion, and money laundering.
None of the allegations have been proven in court.
The Indexed Finance and KyberSwap exploits
According to the indictment, Medjedovic first targeted the DeFi Indexed Finance in October of 2021 and was able to bilk US$16.5 million in investor cryptocurrency from what’s known as “liquidity pools.”
The liquidity pools, which the DOJ said functions like a mutual fund in traditional finance, hold an index of digital “tokens,” and are autonomously managed by a computer code called “smart contracts,” which the Bank of Canada defines as a “custodian” that executes automatically based on “predetermined conditions.”
“Medjedovic used hundreds of millions of dollars in borrowed cryptocurrencies to distort a process called ‘re-indexing,’ which was used by the Indexed Finance smart contracts to add a new token to the liquidity pools. Medjedovic used the borrowed cryptocurrency to engage in manipulative trading to cause the Indexed Finance smart contracts to set artificial prices during the re-indexing process,” officials said in a prepared statement.
Then, two years later, Medjedovic allegedly carried out a similar scam on KyberSwap, but this time investigators said he made off with US$48.8 million.
The indictment stated that in that case, Medjedovic attempted to extort KyberSwap’s developers after the fact and demanded control of the platform, for which he would return 50 per cent of the cryptocurrency he had stolen.
“I know this is probably less than what you wanted. However, it is also more than you deserve,” he allegedly wrote in a message to KyberSwap and investors on the platform.
Accused allegedly bragged about scam to others, journalist
Sometime between the two instances of alleged fraud, investigators said Medjedovic discussed his first crime on “various electronic communication services.”
“For instance, in or about October 2021, shortly after the Indexed Finance exploit, the defendant Andean Medjedovic messaged another user, ‘I did something very cool but accidentally doxxed myself in the process. I may be on the run forever now…Need some advice about becoming a pirate,” the indictment read.
In an another incident, Medjedovic allegedly discussed his conduct with an unnamed journalist.
“’I mean, luckily my first time is small, no one cares about some kid dude [sic] give me some time lol a few more years is all I need.’ The journalist responded, ‘Some time to grow something real or steal more money?’ Medjedovic replied, ‘both.’”
Medjedovic also allegedly conspired with an unnamed individual, who was not named but is identified as a relative of the accused.
The indictment goes on to say that Medjedovic attempted to launder the proceeds of his alleged crimes, but ran into issues trying to “bridge” US$42 million worth of fraudulently obtained cryptocurrency to the decentralized blockchain, Ethereum, because they could be traced back to the KyberSwap “exploit.”
“On or about January 21, 2024, Medjedovic messaged the support channel for bridge protocol, ‘I’m willing to offer $50k in order to get my $100k unfrozen…If not, I have no other options but to alert [] authorities.’ The protocol support service replied, ‘You want to alert the authorities…that you hacked kyber and stole user funds..’ Medjedovic replied, ‘Yes, I am willing to alert the authorities. Committing a crime against someone who may or may not be a criminal is still a crime.”
At some point, Medjedovic was introduced to an individual who, unbeknownst to him, was an undercover law enforcement employee, the court documents suggest. Medjedovic believed that the individual could help him move the proceeds of the KyberSwap heist and paid him roughly US$86,000 to do so.
Lawsuit says Medjedovic used ‘formidable mathematical prowess’ to pull off scheme
Cicada 137 LLC, a corporation that held cryptocurrency on behalf of a small number of investors on Indexed Finance, filed a lawsuit against Medjedovic in 2021 and accused him of using his “formidable mathematical prowess” to carry out the “complex computer hack.”
The lawsuit noted that Medjedovic began moving “several millions” of dollars of their cryptocurrency once he learned of a court order authorizing a search and freeze of his crypto wallets, but stopped within an hour of officially receiving the notice.
Medjedovic had been living with his parents prior to the court order, which also allowed for a search of their home. The lawsuit stated Medjedovic’s parents said he had moved out, taken his computers, and that they did not known where he was.
Medjedovic did make at least one court appearance related to the suit, via videoconference with his camera turned off. He was later found in contempt of court and a warrant was issued for his arrest.
Justice Fred Myers, an Ontario Superior Court of Justice who presided over the hearings, wrote in 2022 that the development represented the “worst outcome for everyone involved” and said it appeared that Medjedovic had gone into hiding.
“While it may let Mr. Medjedovic hold the disputed cryptocurrency tokens for now, he does so under the cloud of a dispute and in the capacity as a wanted person. It is no way for a 19 year old who already holds a master’s degree in mathematics from a prestigious university program to commence his otherwise promising career,” Myers wrote.