Incident and Laundering Scale
Published 6/25/2026, 6:40:06 AM
The KyberSwap exploit, which resulted in a total loss of $48.8 million in November 2023, has become a pivotal case study in hacker accountability. While the use of Tornado Cash has historically provided a veil of anonymity, the subsequent legal actions against the identified hacker, Andean Medjedovic, and the developers of the mixing protocol itself, signal a tightening net around DeFi exploits.
Incident and Laundering Scale
The exploit initially drained approximately $48.8 million from KyberSwap [Source: https://news.bitcoin.com/kyberswap-exploiter-medjedovic-tornado-cash-2026/]. While $4.7 million was partially returned, the remaining funds have been systematically moved through Tornado Cash in increasingly large tranches.
| Date | Action | Amount (ETH) | Estimated Value |
|---|---|---|---|
| Oct 2024 | Laundering Move | 600 ETH | $1.65M |
| Mar 2025 | Laundering Move | 1,600 ETH | $3.72M |
| Apr 2026 | Largest Single Move | 2,900 ETH | $6.8M |
The hacker, 21-year-old Canadian national Andean Medjedovic, remains a fugitive as of June 2026, despite being under indictment by the U.S. Department of Justice (DOJ) [Source: https://news.bitcoin.com/kyberswap-exploiter-medjedovic-tornado-cash-2026/].
Impact on Hacker Accountability
The KyberSwap case has shifted the landscape of accountability in three primary ways:
- Criminalization of "White Hat" Extortion: Medjedovic was charged in February 2025 with wire fraud and money laundering. Crucially, his demands for a "bounty" in exchange for returning funds were classified as attempted extortion, setting a precedent that exploiters cannot use "negotiation" as a legal shield [Source: https://news.bitcoin.com/kyberswap-exploiter-medjedovic-tornado-cash-2026/].
- Protocol-Level Liability: The August 2025 conviction of Tornado Cash co-founder Roman Storm for operating an unlicensed money-transmitting business establishes that developers may be held liable if they maintain functional control over tools used for laundering [Source: https://www.theblock.co/post/265429/kyber-hacker-control-message].
- International Enforcement Synergy: The investigation involves a coalition of the FBI, IRS, and Dutch law enforcement. This cross-border cooperation aims to track technically sophisticated actors even when they use privacy-preserving infrastructure [Source: https://news.bitcoin.com/kyberswap-exploiter-medjedovic-tornado-cash-2026/].
Current Status and Recovery Prospects
As of mid-2026, the prospects for full asset recovery remain low due to the nature of the Tornado Cash protocol, which continues to function despite legal pressures on its founders. Medjedovic's recent movement of 2,900 ETH in April 2026 suggests he is actively liquidating stolen assets to fund his life as a fugitive [Source: https://news.bitcoin.com/kyberswap-exploiter-medjedovic-tornado-cash-2026/].
While the laundering mechanism complicates on-chain tracing, the legal precedents set by this case—specifically the rejection of "code is law" as a criminal defense—mark a significant shift toward holding DeFi exploiters personally and legally accountable for their actions.