U.S. charges Canadian for alleged crypto hack
According to the indictment, Medjedovic, who has a masters in mathematics from the University of Waterloo, exploited vulnerabilities in the DeFi protocols, KyberSwap and Indexed Finance, to steal millions in crypto from other investors in their liquidity pools.
The DoJ alleged that, in 2023, Medjedovic, “used hundreds of millions of dollars in borrowed cryptocurrency to create artificial prices in the KyberSwap liquidity pools,” and “calculated precise combinations of trades that would cause the KyberSwap [protocol] to ‘glitch,’ in his words, allowing him to steal tens of millions of dollars in cryptocurrency from the liquidity pools.”
It also alleged that, earlier, he used a similar tactic to exploit the Indexed Finance DeFi protocol, using borrowed crypto to cause the protocol’s smart contracts to set artificial prices, and then steal crypto from its liquidity pools.
The DoJ alleged that Medjedovic stole approximately US$48.8 million in crypto from KyberSwap liquidity pools, and took about US$16.5 million from the Indexed Finance protocol.
It also alleged that Medjedovic attempted to launder the proceeds through cryptocurrency mixers, and that he tried to extort the KyberSwap developers, seeking control of the protocol in exchange for about half of the stolen crypto.
Allegations against Medjedovic have also been at the centre of some early litigation in Canada involving the crypto sector.
In 2021, an Ontario court issued a warrant for Medjedovic’s arrest, in response to a pair of ongoing legal actions against him, including a proposed class action brought over the alleged Indexed Finance hack.
In its decision, the Superior Court of Justice declined to rule that Medjedovic was in contempt of court for evading the proceedings against him, but said that he should face a contempt of court hearing.
“He is a young man whom, I fear, is caught between the law and a set of rules that he asserts operates independently. The only way he can show that he is or ought to be held to be correct is by participating and making the case that he asserts,” the court said.
Lawful by definition
The court noted that there’s a theory in some crypto circles that because blockchain technology is based on publicly available computer code — and under the claim that ‘the code is law’ — any trading that can be carried out within the parameters of the code is lawful by definition.
“The theory postulates that voluntary participants accept and are bound by the results of the use of the technology. That means that if a clever person can devise a way to exploit a loophole or weakness in the code to induce the holder to enter into an unexpected and unfavourable transaction, more power to him or her,” the court said.
In this case, “Medjedovic used his formidable mathematical prowess to devise and unleash a complex computer attack against Index Finance and essentially induced it to send him $15 million in others’ cryptocurrency tokens,” the Ontario court noted. “The plaintiff says he ‘hacked’ the system to trick it and defraud participants of their assets. The defendant may argue that he did no more than what the code allowed and the code is law.”
“Whether the Ontario common law supports this legal theory might well be in issue in this action — if Andean Medjedovic participates,” it said.
None of the allegations against Medjedovic have been proven, and he is presumed to be innocent on the criminal charges against him in the U.S.
According to the DoJ, Medjedovic is not in custody.