A 22-year-old Canadian national faces federal charges in New York after allegedly exploiting vulnerabilities in two decentralized finance protocols to steal approximately $65 million from investors. The indictment, unsealed on February 3, 2025, reveals a sophisticated multi-year scheme that targeted KyberSwap and Indexed Finance between 2021 and 2023, exposing critical weaknesses in automated smart contract systems.
The Exploit Mechanics
According to court documents, Andean Medjedovic exploited specific vulnerabilities in the automated smart contracts governing both KyberSwap and Indexed Finance. The attack vector involved a technique known as “precision manipulation” — borrowing hundreds of millions of dollars in digital tokens through flash loans and executing deceptive trades designed to corrupt the protocols’ internal price calculations.
In the KyberSwap exploit, the attacker manipulated the protocol’s concentrated liquidity mathematics. By strategically placing and removing liquidity at specific price ranges, the attacker caused the smart contract to miscalculate key variables such as token reserves and exchange rates. This allowed the withdrawal of investor funds at artificially inflated prices, rendering victim positions essentially worthless.
The Indexed Finance attack followed a similar pattern. Medjedovic allegedly exploited a rebalancing vulnerability in the protocol’s index pool contracts, using borrowed capital to distort weight calculations and extract value from legitimate liquidity providers. The total losses across both protocols reached approximately $65 million.
Bitcoin trades at $101,405 and Ethereum at $2,884 as of February 3, providing context for the scale of these losses in the current market environment where total crypto market capitalization stands above $3.5 trillion.
Affected Systems
The KyberSwap exploit primarily affected users of the KyberSwap Elastic protocol, a concentrated liquidity automated market maker deployed across multiple chains including Ethereum, Arbitrum, Optimism, and Polygon. Liquidity providers in specific farming pools bore the brunt of the losses.
Indexed Finance, a smaller protocol offering auto-rebalancing index tokens on Ethereum, suffered significant depletion of its index pools. Users holding index tokens representing diversified crypto portfolios found their holdings rendered nearly valueless as the underlying reserves were drained.
The cascading impact extended beyond direct victims. Other DeFi protocols integrated with or relying on price feeds from affected pools experienced temporary disruptions, highlighting the interconnected nature of decentralized finance infrastructure.
The Mitigation Strategy
Following the exploits, both protocols implemented emergency measures. KyberSwap temporarily paused affected pools and launched an investigation with blockchain security firms. The protocol subsequently offered a bug bounty program and engaged in negotiations with the attacker, who initially demanded control of the entire protocol in exchange for returning stolen funds.
The broader DeFi community responded with increased scrutiny on concentrated liquidity implementations. Several major protocols, including Uniswap and PancakeSwap, conducted internal audits of their own concentrated liquidity code to identify similar vulnerabilities.
Security researchers emphasize that precision-based attacks remain one of the most challenging attack vectors to defend against, as they exploit the mathematical foundations of automated market making rather than traditional code bugs.
Lessons Learned
The Medjedovic indictment underscores several critical lessons for the DeFi ecosystem. First, complex mathematical implementations in smart contracts require multiple independent audits from specialized firms. Standard security reviews may not catch precision-based vulnerabilities that only emerge under specific trading conditions.
Second, the case demonstrates the importance of circuit breakers and pause mechanisms. Protocols that can rapidly halt operations during suspicious activity can significantly limit losses. The time between initial exploitation and protocol response directly correlates with total damages.
Third, the attacker’s attempt to extort the KyberSwap community into surrendering protocol governance illustrates the growing intersection between technical exploits and social engineering in DeFi crime.
User Action Required
For DeFi users, this case serves as a reminder to diversify across protocols and never concentrate an entire portfolio in a single platform’s liquidity pools. Users should regularly monitor their positions for unusual activity and set up alerts for significant value changes.
Investors should also verify that protocols they use have undergone recent security audits from reputable firms, maintain active bug bounty programs, and operate transparent governance processes. The absence of any of these safeguards represents a material risk factor that should inform allocation decisions.
Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice. Always conduct your own research before engaging with any DeFi protocol.
precision manipulation via flash loans, the classic attack vector. $65m from a 22 year old is wild though
borrowing hundreds of millions through flash loans to corrupt price feeds… and nobody flagged the tx in real time? cmon
slack_auditor_ flash loans arent invisible. mempool watchers see them pending. the problem is no protocol has real-time circuit breaking on suspicious tx patterns
flash loan attacks are basically invisible until the tx executes. by the time anyone flags it, the funds are already bridged out
slack_auditor_ the tx was public but flash loans execute atomically. you can see it pending in the mempool but by the time it confirms the funds are already gone. real-time circuit breakers dont exist on most protocols
precision manipulation on concentrated liquidity math is the scary part. most AMM audits check standard curve formulas but CLAMMs with custom tick spacing have edge cases that auditors routinely miss
most audits fuzz happy paths only. invariant tests on tick boundaries would have caught the rounding window years before the indictment did
The KyberSwap concentrated liquidity exploit was particularly clever. Corrupting internal price calculations by strategically placing and removing liquidity at specific ranges.
^ this is why i never touch concentrated liquidity pools without reading the audit first. the math gets gnarly fast
Tomoko H. the concentrated liquidity math was correct under normal conditions. the attacker found edge cases in the tick spacing that created rounding errors exploitable at scale
the precision manipulation angle is what makes concentrated liquidity so dangerous. the math looks correct until you realize the attacker designed the inputs to break the assumptions
Multi-year scheme from 2021 to 2023 and they only caught him now. Makes you wonder how many active exploits are still running undetected.
22 years old and figured out precision manipulation across two protocols. the math on concentrated liquidity exploits is genuinely hard and this kid found the rounding errors nobody else saw
flash loan plus precision manipulation is basically the infinite money glitch for DeFi. KyberSwap CLMM math was publicly audited and still nobody caught the rounding exploit. audit quality matters more than audit count
22 years old and pulled off a multi-protocol precision manipulation across years. imagine what state-sponsored attackers with full time teams can do
Devon B. 22 years old with enough understanding of concentrated liquidity math to exploit it across multiple protocols. imagine what a funded team could do
22 years old and he ran a multi-year precision manipulation campaign across KyberSwap AND Indexed Finance. imagine the zero-days that arent being reported because the exploiter isnt sloppy enough to get caught
rekt_forensics 22 years old and smart enough to exploit KyberSwap tick math but dumb enough to leave a trail. imagine the exploits that never get found because the attacker has opsec
22 years old and pulled off a multi-year scheme across two protocols. the sophistication here suggests this wasnt impulse crime but planned exploitation. the justice system treating it like a bank robbery is the right framing
precision_kep_ ‘found the rounding errors’ is generous. he borrowed hundreds of millions in flash loans and corrupted the price calculation. thats exploitation not research
22 years old and figured out a multi-year exploit across two protocols. imagine what actual nation-state teams are doing right now
KyberSwap elastic pools had the same reentrancy pattern that Indexed was using. both teams shipped code without proper fuzzing. this is what happens when audit budgets are $5K
Indexed Finance exploit was a simple precision attack on the power equation. 3 lines of code reviewed by nobody. when your auditor is a rubber stamp this is what happens
kyberswap dynamic AMM was supposed to be an upgrade. turns out the flexibility in concentrated liquidity positions created more attack surface than the old constant product formula ever had
Three lines, two audits, zero catches. The exploit was just the receipt for an audit industry that rubber stamps concentrated liquidity math
22 years old, 65 million stolen, and the trail held together because the cashout ran through a KYC exchange. the tradecraft fell apart at the exit