Andean Medjedovic, the Canadian national charged by the U.S. Department of Justice for stealing $65 million across two decentralized finance (DeFi) exploits, moved 2,900 ETH worth $6.8 million to Tornado Cash on Wednesday, April 29, 2026. The transfer was detected by blockchain surveillance tools, raising concerns that the fugitive is actively attempting to launder proceeds from one of the most technically sophisticated DeFi hacks in history.
Key Takeaways
- Medjedovic transferred 2,900 ETH ($6.8M) to Tornado Cash on April 29, 2026.
- The DOJ charged him in February 2025 for the $48.8M KyberSwap and $16.5M Indexed Finance exploits.
- He remains at large despite involvement of FBI, IRS, Homeland Security, and international cooperation from Dutch authorities.
A Fugitive Still Moving Funds
The move to Tornado Cash, a cryptocurrency mixer designed to obscure transaction trails, suggests that Medjedovic might be actively attempting to launder exploit proceeds that federal prosecutors have described as among the “most technically sophisticated” in DeFi history. The mixer was sanctioned by the U.S. Treasury in 2022, meaning its use by someone already facing federal money laundering charges compounds Medjedovic’s legal exposure, assuming he is ever arrested.
Medjedovic was charged in February 2025 with wire fraud, unauthorized damage to a protected computer, attempted Hobbs Act extortion, money laundering conspiracy, and money laundering. He has remained a fugitive despite a multi-agency manhunt involving the FBI, IRS, Homeland Security Investigations, and Dutch law enforcement.
How the Exploits Worked
Medjedovic targeted both Indexed Finance and KyberSwap using a variation of the same method. He borrowed large volumes of digital tokens through flash loans and executed a sequence of trades engineered to cause the protocols’ automated market maker (AMM) smart contracts to miscalculate key internal price variables. Operating on code logic rather than human oversight, the contracts then allowed Medjedovic to withdraw funds at artificial prices that made his exits far more profitable than the actual market rate.
The Indexed Finance attack in 2021 netted approximately $16.5 million, while the KyberSwap exploit on November 23, 2023, was substantially larger — Medjedovic drained roughly $48.8 million from the protocol. He initially moved 800 ETH in the months following that attack, establishing a pattern of gradual fund dispersal. Wednesday's transfer of 2,900 ETH to Tornado Cash represents the largest single confirmed laundering move since then.
Beyond the hacks, federal prosecutors charged Medjedovic with attempted extortion because, after the KyberSwap exploit, he allegedly demanded compensation from the protocol in exchange for returning a portion of stolen assets. His whereabouts remain unknown, with no arrest made to date.