Key Takeaways:
- Andean Medjedovic moved 2,900 ETH worth $6.8 million to Tornado Cash on April 29, 2026.
- The DOJ charged Medjedovic in February 2025 for the $48.8M Kyberswap and $16.5M Indexed Finance hacks.
- Medjedovic remains a fugitive despite FBI, IRS, and Homeland Security involvement in the investigation.
A Fugitive Still Moving Funds
The move to Tornado Cash, a cryptocurrency mixer designed to obscure transaction trails, suggests that Medjedovic might be actively attempting to launder exploit proceeds that federal prosecutors have described as among the “most technically sophisticated” in Defi history.
Medjedovic was charged by the U.S. Department of Justice in February 2025 with wire fraud, unauthorized damage to a protected computer, attempted Hobbs Act extortion, money laundering conspiracy, and money laundering. As Bitcoin.com reported at the time, he has remained at large despite the involvement of the FBI, the Internal Revenue Service, Homeland Security Investigations, and international cooperation from Dutch law enforcement authorities.
How the Exploits Worked
Medjedovic targeted both Indexed Finance and Kyberswap using a variation of the same method in which he borrowed large volumes of digital tokens through flash loans and executed a sequence of trades engineered to cause the protocols’ automated market maker ( AMM) smart contracts to miscalculate key internal price variables.
Operating on code logic rather than human oversight, the contracts then allowed Medjedovic to withdraw funds at artificial prices that made his exits far more profitable than the actual market rate.
The Indexed Finance attack in 2021 netted approximately $16.5 million, while the Kyberswap exploit on November 23, 2023, was substantially larger, with Medjedovic draining roughly $48.8 million from the protocol. He then moved 800 ETH in the months following that attack, establishing a pattern of gradual fund dispersal.
Wednesday’s transfer of 2,900 ETH to Tornado Cash represents the largest single confirmed laundering move since then. The full scope of what Medjedovic has converted or moved since the exploits remains unclear from onchain data alone.
Beyond the hacks, federal prosecutors have also charged Medjedovic with attempted extortion because, after the Kyberswap exploit, he allegedly demanded compensation from the protocol in exchange for returning a portion of stolen assets.
Lastly, Tornado Cash was sanctioned by the U.S. Treasury in 2022, meaning its use by someone already facing federal money laundering charges compounds Medjedovic’s legal exposure, assuming he is ever arrested. His whereabouts remain unknown, with no arrest having been made to date.
