A five-count criminal indictment was unsealed in federal court in New York charging a Canadian man with “exploiting vulnerabilities” in decentralized finance protocols to “fraudulently obtain about $65 million from the protocols’ investors.”
According to court documents, from 2021 to 2023, Andean Medjedovic, 22, allegedly exploited vulnerabilities in the automated smart contracts used by the KyberSwap and Indexed Finance decentralized finance protocols.
Medjedovic borrowed hundreds of millions of dollars in digital tokens, which he used to “engage in deceptive trading that he knew would cause the protocols’ smart contracts to falsely calculate key variables.”
Through his deceptive trades, Medjedovic was able to, and ultimately did, withdraw “millions of dollars of investor funds from the protocols at artificial prices, rendering the victims’ investments essentially worthless.”
Medjedovic also allegedly laundered the proceeds of his fraudulent schemes through a “series of transactions designed to conceal the source and ownership of the funds,” including through swap transactions, “bridging transactions,” and the use of a digital assets “mixer.”
With others, Medjedovic also allegedly “schemed to open accounts with digital assets exchanges using false and borrowed identifying information to conceal the source and true ownership of the proceeds.”
In around November 2023, after executing the KyberSwap exploit, Medjedovic also allegedly attempted to “extort the victims of the KyberSwap exploit through a sham settlement proposal, in which he demanded complete control of the KyberSwap protocol and the decentralized autonomous organization that oversaw the KyberSwap protocol in exchange for returning 50 percent of the digital assets that he fraudulently obtained through his scheme.”
Medjedovic is charged with “one count of wire fraud, one count of unauthorized damage to a protected computer, one count of attempted Hobbs Act extortion, one count of money laundering conspiracy, and one count of money laundering.”
If convicted, he faces a maximum “penalty of 10 years in prison on the unauthorized damage to a protected computer count and 20 years in prison on each of the other counts.”
A federal district court judge will “determine any sentence after considering the U.S. Sentencing Guidelines and other statutory factors.”
Supervisory Official Antoinette T. Bacon of the Justice Department’s Criminal Division, U.S. Attorney John J. Durham for the Eastern District of New York, Chief Guy Ficco of IRS Criminal Investigation (IRS-CI), Special Agent in Charge William S. Walker of Homeland Security Investigations (HSI) New York, and Assistant Director in Charge James E. Dennehy of the FBI New York Field Office made the announcement.
IRS-CI, HSI, and the FBI New York Field Office are investigating the case, with valuable assistance “provided by U.S. Customs and Border Protection’s New York Field Office and the Justice Department’s Office of International Affairs.”
Trial Attorney Tian Huang of the Criminal Division’s Fraud Section, who is a member of the National Cryptocurrency Enforcement Team (NCET), and Assistant U.S. Attorneys Nicholas Axelrod and Andrew Reich for the Eastern District of New York are prosecuting the case.
SEC Enforcement Attorney Daphna A. Waxman, formerly a member of the NCET, provided “significant assistance.”