A cross-border DeFi theft case is escalating into a messy mix of on-chain dormancy and offline legal uncertainty. U.S. prosecutors allege a Canadian national stole about $65 million from Indexed Finance and KyberSwap by exploiting smart-contract weaknesses and market mechanics, and that much of the proceeds now sit in largely inactive wallets. That combination—known funds that aren’t moving, and a suspect who is—keeps the risk profile unusually open-ended for both investigators and market participants.
The situation became more complicated after a short, high-stakes run through Serbian custody. An arrest in Belgrade on August 9, 2024 was followed by a Serbian court decision that blocked a Dutch extradition request, and the accused was released on November 22, 2024 before later disappearing from view. U.S. filings then raised the temperature again when the Department of Justice stated on January 17, 2025 that the individual was “at large in Bosnia.”
This week, a criminal indictment was unsealed against Andean Medjedovic, a Canadian national who allegedly manipulated two decentralized finance protocols to obtain about $65 million in illicit funds from the protocols’ investors. https://t.co/peirBeNDJ3 pic.twitter.com/YHkoGmq9vk
— FBI (@FBI) February 5, 2025
What prosecutors say happened on-chain
U.S. prosecutors say the alleged scheme began in October 2021 and focused on vulnerabilities in smart contracts and liquidity plumbing at Indexed Finance and KyberSwap. The government’s position is that the theft blended technical weaknesses with market manipulation, turning protocol mechanics into a cash-out path. After the alleged exploits, the proceeds were converted into cryptocurrencies and moved into a set of wallets that, according to tracking by blockchain intelligence firms, have remained mostly dormant.
That dormancy is not a comfort blanket for institutions—it is a live risk variable. For treasuries and institutional traders, the key operational reality is that the stolen assets are still on-chain, which means any reactivation could translate into sudden liquidity pressure and rapid routing attempts. In parallel, forensics teams are leaning on transaction graphs and custody metadata to link movements and preserve evidence for prosecution and potential recovery actions.
Why the legal timeline keeps the risk open
The offline timeline reads like a case study in jurisdictional friction. The accused reportedly left Canada in late 2021 and traveled internationally over the next four years, including through Brazil, Dubai, Spain and the Netherlands, while allegedly using aliases and false travel documents. Serbian authorities arrested him, but the Serbian court later denied a Dutch extradition request—citing insufficient evidence and sentencing considerations—resulting in his release.
U.S. authorities have since formalized their posture. The Department of Justice filed criminal charges tied to the alleged $65 million theft and stated the suspect was at large in Bosnia as of January 17, 2025, while Interpol issued a Red Notice as enforcement efforts broadened. With multiple jurisdictions in play, the path to apprehension—and any eventual asset freezing or repatriation—becomes a coordination problem as much as a legal one.
For the market, the takeaway is practical rather than theoretical. This case reinforces that protocol security, incident response, and compliance monitoring are now part of the same operating model, because the attack surface and the recovery process both span borders. In the near term, the most actionable posture is continuous monitoring of the dormant wallets and fast detection of any movement, paired with tighter watchlists and withdrawal controls tied to addresses flagged by investigators.