Canadian Teen Hacker ‘Andy’ Medjedovic Charged With Stealing $65M in Crypto Hacks

U.S. prosecutors have charged a 22-year-old Canadian man with stealing a combined $65 million in crypto through two separate decentralized finance (DeFi) hacks

A 22-year-old Canadian national has been charged by U.S. prosecutors for allegedly stealing a total of $65 million in cryptocurrency through two separate decentralized finance (DeFi) hacks – the 2021 Indexed Finance exploit and the 2023 KyberSwap hack.

According to a newly unsealed indictment filed in the Eastern District of New York (EDNY), Andean “Andy” Medjedovic is accused of being the mastermind behind both exploits. While Medjedovic's alleged involvement in the KyberSwap hack was previously unknown, he had publicly admitted to carrying out the Indexed Finance attack, which siphoned off $16 million from the DeFi platform when Medjedovic was still a teenager.

Medjedovic made little effort to conceal his identity in the Indexed Finance hack, as he claimed to believe that his actions were not illegal. Another DeFi hacker, Avraham “Avi” Eisenberg, adopted a similar "code is law" stance following his 2022 Mango Markets exploit, arguing that his withdrawal of $110 million from the decentralized exchange was legal. However, a New York jury found Eisenberg guilty of fraud and market manipulation. He is scheduled to be sentenced later this year and could face up to 20 years in prison.

Medjedovic has been on the run since December 2021, when a Canadian court issued a warrant for his arrest. In 2023, he told a DeFi Llama reporter that it was "exhausting" to live as a fugitive, revealing that he had been bouncing around Europe, South America and an unnamed island nation during his time on the lam. A spokesperson for the Eastern District of New York (EDNY) informed CoinDesk that Medjedovic is still “at large” and is not believed to be present in the United States.

Eight months after disclosing to the same reporter that he had become a whitehat hacker, prosecutors allege that Medjedovic stole approximately $50 million from KyberSwap. The indictment states that Medjedovic planned the KyberSwap hack for months prior to executing it, writing to himself “Find time to Strike!” and outlining a “POST-EXPLOITATION” plan for himself.

In one file, Medjedovic reportedly reflected on his past mistakes, writing “Going On the run / Yes / Chance of getting caught

Medjedovic has been charged with one count of wire fraud, one count of unauthorized damage to a protected computer, one count of attempted Hobbs Act extortion, one count of money laundering conspiracy and one count of money laundering. He faces a maximum penalty of 90 years in prison if convicted on all charges.