Canadian Man Charged for Exploiting DeFi Vulnerabilities in $65M Hacking Scheme – Decrypt

A Canadian man has been indicted for allegedly exploiting vulnerabilities in two decentralized finance protocols to fraudulently get hold of roughly $65 million from buyers, together with these within the U.S. 

The indictment prices 22-year-old Andean Medjedovic with manipulating the sensible contracts of decentralized change aggregators KyberSwap and Listed Finance between 2021 and 2023, withdrawing investor funds at synthetic costs and rendering their investments nugatory.

Regardless of the indictment, Medjedovic stays at massive. Legislation enforcement companies are actively pursuing his whereabouts, with assist from the Netherlands’ Public Prosecution Service and the Dutch Nationwide Police Cybercrime Unit in The Hague.

Medjedovic is dealing with 5 prices, together with one depend of wire fraud, one depend of unauthorized injury to a protected pc, one depend of tried Hobbs Act extortion (refers to the usage of pressure, threats, or worry to unlawfully get hold of property), and two counts of cash laundering, the U.S. Division of Justice introduced Monday.

“If convicted, he faces a most penalty of 10 years in jail on the unauthorized injury to a protected pc depend and 20 years in jail on every of the opposite counts,” the division stated.

The person allegedly borrowed a whole lot of thousands and thousands of {dollars} in digital tokens and engaged in a sequence of misleading trades that tricked the automated sensible contracts into miscalculating key monetary variables, in accordance with the indictment.

The indictment particulars how he allegedly used swap transactions to change the stolen tokens for different digital property, carried out bridging transactions to maneuver funds throughout completely different blockchains and relied on digital asset mixers to obscure the true circulate of cash. 

Prosecutors additionally allege that Medjedovic and his associates opened accounts at varied crypto exchanges utilizing false and borrowed identities to additional cowl their tracks.

Following the Listed Finance hack, he allegedly conspired with one other individual to launder the proceeds via change accounts opened utilizing false KYC (Know Your Buyer) data. 

The indictment reveals Medjedovic maintained an in depth step-by-step playbook for obfuscating transactions, which he titled a “moneyMovementSystem”.

At one level, after one bridge protocol froze a number of of his transactions, Medjedovic allegedly paid an undercover legislation enforcement agent—who posed as a software program developer—$80,000 to bypass restrictions and unlock $500,000 in stolen crypto.

In November 2023, Medjedovic allegedly executed an exploit concentrating on KyberSwap, a DeFi protocol working on Ethereum, Arbitrum, and different blockchains. 

By forcing the protocol’s liquidity swimming pools to “glitch,” in his phrases, Medjedovic was in a position to drain $48.8 million in investor funds throughout 77 KyberSwap liquidity swimming pools.

Following the exploit, Medjedovic allegedly tried to extort KyberSwap builders, buyers, and members of its decentralized autonomous group (DAO) via a “sham settlement proposal.”

The indictment comes as world legislation enforcement continues cracking down on cyber-enabled monetary crimes. 

In a separate case, Delhi Police’s Intelligence Fusion and Strategic Operations (IFSO) division arrested a person from West Bengal in reference to a $235 million cyberattack on India’s largest crypto change, WazirX.

Edited by Sebastian Sinclair