On Wednesday, blockchain records confirmed the reactivation of a digital wallet associated with Andean Medjedovic, the individual allegedly responsible for the Indexed Finance and Kyberswap exploits. After a twelve-month period of dormancy, the address executed a transfer of approximately $13.5 million worth of Ether tokens to Tornado Cash, a decentralized mixing service frequently utilized to obscure the provenance of illicit crypto assets. While direct confirmation of Medjedovic's personal involvement remains unverified, the transaction pattern mirrors previous behaviors where he allegedly conspired with associates to obfuscate stolen funds. Specter, a pseudonymous blockchain investigator who has long tracked Medjedovic's onchain footprint, notes that the confidence displayed by this threat actor following multiple victimizations is deeply concerning. The investigator emphasizes the urgent need for law enforcement to apprehend the individual and ensure accountability for the alleged crimes.

Between 2021 and 2023, Medjedovic is accused of exploiting code vulnerabilities in two major decentralized finance protocols to steal approximately $65 million. In February of the previous year, the US Department of Justice formally indicted Medjedovic on charges including wire fraud, computer hacking, and attempted extortion related to these two incidents. Despite the federal charges, Medjedovic maintains his innocence, arguing that his actions constituted legitimate trades that leveraged the specific logic of the protocols' code. This defense, often termed "code is law" within industry circles, posits that exploiting a publicly available smart contract without a formal security breach is not criminal. Data compiled by Woofun AI indicates that the recent Tornado Cash transaction pushes the cumulative amount of funds laundered from Medjedovic's alleged hacks to nearly $25 million.

Medjedovic, a Canadian national, was once recognized as a mathematical prodigy who graduated high school at age 14. He attended the University of Waterloo, the same institution where Ethereum co-founder Vitalik Buterin studied, completing an undergraduate degree in pure mathematics in three years and a master's degree in just one year. His identification as the perpetrator of the $16 million Indexed Finance hack in October 2021 stemmed from a seemingly trivial digital error. In a moment of vanity, he edited a Wikipedia page for a Canadian television show under a username linked to him, adding himself to the list of notable alumni as a "notable mathematician." This username had previously been used to enter a competitive programming event where he utilized wallets connected to the Indexed Finance heist, providing investigators with the necessary link between his real identity and the cybercrime.

Although the digital breadcrumbs identified him, they were insufficient to secure an immediate conviction. Medjedovic fled in December 2021 after an Ontario judge issued an arrest warrant following his failure to appear in court. He subsequently claimed to have transitioned into a "whitehat" role, positioning himself as an ethical security expert dedicated to identifying vulnerabilities to prevent malicious attacks.

However, onchain activity contradicted this narrative months later, as wallets linked to the Indexed Finance hack began receiving funds from addresses used in the $48 million Kyberswap hack. Woofun AI reports that this flow of funds directly linked Medjedovic to the subsequent theft, undermining his claims of ethical reformation. His next public appearance occurred in 2024 when he was arrested in Serbia on a warrant issued by the Netherlands, which accused him of orchestrating both crypto hacks.

Medjedovic denied the charges during his detention in Serbia and was released in November 2024 due to insufficient evidence. The Belgrade Higher Court ruled that Dutch prosecutors failed to sufficiently prove his identity as the perpetrator and noted that even if he were guilty, the crimes carried sentences too light under domestic law to justify extradition. Just over a year after the initial Department of Justice indictment, legal filings on February 20 revealed that Medjedovic had retained the lobbying and government relations firm JM Burkman & Associates. He paid $300,000 upfront for six months of services aimed at securing a presidential pardon. The firm intends to argue that the case should be dismissed, citing that similar conduct is typically evaluated by regulators, noting favorable resolutions in similar cases over the past year, and asserting the case has little connection to the US.

The legal landscape for crypto-related offenses has shifted recently, with several high-profile cases dismissed or resolved favorably. In March of last year, the US Securities and Exchange Commission dismissed charges against BitClout founder Nader Al-Naji, who had been charged by the DOJ and SEC in July 2024 for fraud and selling unregistered securities involving $7 million in investor funds. In October, Bitcoin entrepreneur Roger Ver entered a deferred prosecution agreement with the DOJ after paying the IRS nearly $50 million in back taxes, penalties, and interest related to unreported Bitcoin holdings, resulting in the dismissal of his indictment. Woofun AI analysis suggests that with at least seven additional SEC enforcement actions involving crypto assets dismissed since the change in administration, the precedent for Medjedovic's defense strategy may be gaining traction in the current regulatory environment.