Andean Medjedovic, the Canadian national charged by the U.S. Department of Justice for stealing $65 million across two decentralized finance (DeFi) exploits, moved 2,900 ETH worth $6.8 million to Tornado Cash on Wednesday, April 29, 2026. This transfer, the largest single laundering move since the Kyberswap hack in November 2023, suggests the fugitive is actively trying to conceal the stolen assets.
Background of the Hacks
Medjedovic was indicted in February 2025 on charges including wire fraud, unauthorized damage to a protected computer, attempted Hobbs Act extortion, money laundering conspiracy, and money laundering. The two exploits targeted Indexed Finance (2021, approximately $16.5 million) and Kyberswap (November 23, 2023, approximately $48.8 million). Federal prosecutors described the attacks as among the 'most technically sophisticated' in DeFi history.
How the Exploits Worked
Both attacks employed a similar method: Medjedovic used flash loans to borrow large volumes of digital tokens and executed a sequence of trades engineered to cause the protocols' Automated Market Maker (AMM) smart contracts to miscalculate key internal price variables. Operating on code logic rather than human oversight, the contracts allowed him to withdraw funds at artificial prices far exceeding the actual market rate. After the Kyberswap hack, he moved 800 ETH in the months following, establishing a pattern of gradual fund dispersal. The April 29 transfer of 2,900 ETH marks a significant acceleration.
Legal Exposure and Fugitive Status
Tornado Cash was sanctioned by the U.S. Treasury in 2022. By using this mixer, Medjedovic compounds his already serious federal money laundering charges. Additionally, the indictment includes an attempted extortion charge for allegedly demanding compensation from Kyberswap in exchange for returning a portion of the stolen assets. Despite involvement from the FBI, IRS, Homeland Security Investigations, and Dutch law enforcement, Medjedovic remains at large with no arrest to date. His whereabouts are unknown, and the full scope of his asset conversions or movements since the hacks remains unclear from on-chain data alone.
The 2,900 ETH transfer to Tornado Cash demonstrates that the alleged hacker is still actively managing the stolen funds, potentially challenging law enforcement efforts. The case continues to attract attention in the crypto community, highlighting the persistent challenges of DeFi security and cross-border cybercrime prosecution.