KyberSwap Heist: Ether Floats Through Tornado Cash-Again!

by

Key Highlights

  • The KyberSwap rascal resumes siphoning stolen ETH in neat 100 ETH parcels, as if he were unpacking a very dull telegram and calling it a process.
  • Transfers slip through Tornado Cash, stirring up a fresh kettle of concerns about tracking wayward crypto and their very own laundering opera.
  • Despite the U.S. charges, the Medjedovic-linked wallet still boasts about $29M, proving the case is less closed book and more pages missing in a seaside edition.

The KyberSwap miscreant has taken to moving the loot again, dispatching Ether (ETH) through Tornado Cash in tidy 100 ETH batches, according to the sages of Arkham. The performer in question is Andean Medjedovic, who filched $48.8 million from KyberSwap in 2023 and previously relieved Indexed Finance of $16.5 million two years prior.

Arkham flagged the transactions in a public missive, stating, “Andean Medjedovic drained $48.8M from KyberSwap in late 2023. Medjedovic also hacked Indexed Finance for $16.5M, 2 years prior. He was charged by the FBI in 2025. Did he… get away with it?” The latest frolic has raised fresh questions about the elusiveness of DeFi capers and the difficulty of tracking stolen crypto funds.

The Kyber Network Exploiter is moving stolen funds to Tornado Cash.

The attacker, Andean Medjedovic, drained $48.8M from KyberSwap in late 2023. Medjedovic also hacked Indexed Finance for $16.5M, 2 years prior. He was charged by the FBI in 2025.

Did he… get away with it?

– Arkham (@arkham) April 29, 2026

Patterned transfers raise red flags

Brace yourselves for the pattern: a clean, coordinated routine of withdrawals exactly 100 ETH apiece, all winging their way to the Tornado Cash Router address. The transfers arrived in rapid-fire succession-some labelled “just now,” others within seconds or minutes of each other-suggesting a deliberate, almost choreographed laundering routine rather than a spur-of-the-moment misadventure.

Meanwhile, the data shows the hacker’s account still sitting on a tidy pile of over $29 million. The portfolio features 11,861 ETH ($27.58M) and 796.39 wstETH ($2.28M), with a few minor coins tagging along for good measure.

Such coordinated transactions are the sort of thing investigators watch with a judicious raise of the eyebrow, since they tend to shout “laundering attempt” louder than a street magician with a rabbit issue.

Moreover, the Tornado Cash service makes it even more disagreeable to determine the origin of the transactions. Once the funds take a spin through such a fog-machine, tracing them back to the owner becomes a game of hide-and-seek with a blindfold on.

Legal pressure meets ongoing activity

Medjedovic, a Canadian national, faces criminal charges in the United States, where prosecutors accuse him of exploiting vulnerabilities in KyberSwap and Indexed Finance to purloin roughly $65 million in total. They allege he borrowed gobs of money, tinkered with trading systems, and withdrew funds at prices that could only be described as theatrical. The indictment, unfurled in February 2025, also references an alleged attempt to extort KyberSwap via a settlement demand tied to the stolen assets.

His whereabouts remain a mystery, with no public confirmation of an arrest. Investigators have previously noted his use of mixers, swaps, and cross‑chain bridges to cloak his tracks-tactics that appear to be enjoying a revival tour with these fresh Tornado Cash deposits.

The affair underscores a wider pickle in DeFi enforcement, as stolen funds can continue to move despite public indictment and charges, laying bare the chasm between blockchain transparency and the horsepower of enforcement.

Read More

2026-04-29 15:55