A 22-year-old Canadian national faces federal charges in New York after allegedly exploiting vulnerabilities in two decentralized finance protocols to steal approximately $65 million from investors. The indictment, unsealed on February 3, 2025, reveals a sophisticated multi-year scheme that targeted KyberSwap and Indexed Finance between 2021 and 2023, exposing critical weaknesses in automated smart contract systems.
The Exploit Mechanics
According to court documents, Andean Medjedovic exploited specific vulnerabilities in the automated smart contracts governing both KyberSwap and Indexed Finance. The attack vector involved a technique known as “precision manipulation” — borrowing hundreds of millions of dollars in digital tokens through flash loans and executing deceptive trades designed to corrupt the protocols’ internal price calculations.
In the KyberSwap exploit, the attacker manipulated the protocol’s concentrated liquidity mathematics. By strategically placing and removing liquidity at specific price ranges, the attacker caused the smart contract to miscalculate key variables such as token reserves and exchange rates. This allowed the withdrawal of investor funds at artificially inflated prices, rendering victim positions essentially worthless.
The Indexed Finance attack followed a similar pattern. Medjedovic allegedly exploited a rebalancing vulnerability in the protocol’s index pool contracts, using borrowed capital to distort weight calculations and extract value from legitimate liquidity providers. The total losses across both protocols reached approximately $65 million.
Bitcoin trades at $101,405 and Ethereum at $2,884 as of February 3, providing context for the scale of these losses in the current market environment where total crypto market capitalization stands above $3.5 trillion.
Affected Systems
The KyberSwap exploit primarily affected users of the KyberSwap Elastic protocol, a concentrated liquidity automated market maker deployed across multiple chains including Ethereum, Arbitrum, Optimism, and Polygon. Liquidity providers in specific farming pools bore the brunt of the losses.
Indexed Finance, a smaller protocol offering auto-rebalancing index tokens on Ethereum, suffered significant depletion of its index pools. Users holding index tokens representing diversified crypto portfolios found their holdings rendered nearly valueless as the underlying reserves were drained.
The cascading impact extended beyond direct victims. Other DeFi protocols integrated with or relying on price feeds from affected pools experienced temporary disruptions, highlighting the interconnected nature of decentralized finance infrastructure.
The Mitigation Strategy
Following the exploits, both protocols implemented emergency measures. KyberSwap temporarily paused affected pools and launched an investigation with blockchain security firms. The protocol subsequently offered a bug bounty program and engaged in negotiations with the attacker, who initially demanded control of the entire protocol in exchange for returning stolen funds.
The broader DeFi community responded with increased scrutiny on concentrated liquidity implementations. Several major protocols, including Uniswap and PancakeSwap, conducted internal audits of their own concentrated liquidity code to identify similar vulnerabilities.
Security researchers emphasize that precision-based attacks remain one of the most challenging attack vectors to defend against, as they exploit the mathematical foundations of automated market making rather than traditional code bugs.
Lessons Learned
The Medjedovic indictment underscores several critical lessons for the DeFi ecosystem. First, complex mathematical implementations in smart contracts require multiple independent audits from specialized firms. Standard security reviews may not catch precision-based vulnerabilities that only emerge under specific trading conditions.
Second, the case demonstrates the importance of circuit breakers and pause mechanisms. Protocols that can rapidly halt operations during suspicious activity can significantly limit losses. The time between initial exploitation and protocol response directly correlates with total damages.
Third, the attacker’s attempt to extort the KyberSwap community into surrendering protocol governance illustrates the growing intersection between technical exploits and social engineering in DeFi crime.
User Action Required
For DeFi users, this case serves as a reminder to diversify across protocols and never concentrate an entire portfolio in a single platform’s liquidity pools. Users should regularly monitor their positions for unusual activity and set up alerts for significant value changes.
Investors should also verify that protocols they use have undergone recent security audits from reputable firms, maintain active bug bounty programs, and operate transparent governance processes. The absence of any of these safeguards represents a material risk factor that should inform allocation decisions.
Disclaimer: This article is for informational purposes only and does not constitute financial or legal advice. Always conduct your own research before engaging with any DeFi protocol.
precision manipulation via flash loans, the classic attack vector. $65m from a 22 year old is wild though
borrowing hundreds of millions through flash loans to corrupt price feeds… and nobody flagged the tx in real time? cmon
slack_auditor_ flash loans arent invisible. mempool watchers see them pending. the problem is no protocol has real-time circuit breaking on suspicious tx patterns
flash loan attacks are basically invisible until the tx executes. by the time anyone flags it, the funds are already bridged out
The KyberSwap concentrated liquidity exploit was particularly clever. Corrupting internal price calculations by strategically placing and removing liquidity at specific ranges.
^ this is why i never touch concentrated liquidity pools without reading the audit first. the math gets gnarly fast
the precision manipulation angle is what makes concentrated liquidity so dangerous. the math looks correct until you realize the attacker designed the inputs to break the assumptions
Multi-year scheme from 2021 to 2023 and they only caught him now. Makes you wonder how many active exploits are still running undetected.
22 years old and pulled off a multi-protocol precision manipulation across years. imagine what state-sponsored attackers with full time teams can do