Key Takeaways:
An address linked to the 2023 KyberSwap exploit transferred 2,900 Ether, valued at $6.8 million, to the sanctioned privacy protocol Tornado Cash on Wednesday, marking a significant step in laundering the proceeds from one of DeFi’s largest hacks.
The transaction was flagged by on-chain analytics platform Arkham, which has been tracking the wallets associated with Andean Medjedovic, the Canadian national charged by the U.S. Department of Justice for the attack.
The fund movement occurred in batches of 100 ETH, a structured pattern suggesting a deliberate attempt to obscure the transaction trail. This transfer is the largest single movement of funds by the exploiter since moving 800 ETH in the months following the initial $48.8 million KyberSwap hack on Ethereum in November 2023. Medjedovic was also behind the $16.5 million exploit of Indexed Finance in 2021.
The move to Tornado Cash complicates recovery efforts for the nearly $29 million in crypto assets that remain in the fugitive’s wallet. Using a mixer sanctioned by the U.S. Treasury in 2022 compounds Medjedovic’s legal exposure, but underscores the persistent challenge law enforcement faces in freezing and reclaiming stolen funds within the DeFi ecosystem.
U.S. authorities indicted Medjedovic in February 2025 on charges including wire fraud, money laundering, and extortion after he allegedly demanded control of the KyberSwap protocol in exchange for returning the assets. Despite an international investigation involving the FBI and Homeland Security, he remains at large.
The KyberSwap exploit was notable for its technical sophistication, involving a flash loan to manipulate the protocol's smart contracts and withdraw funds at artificially distorted prices. Wednesday's transfer demonstrates that despite the charges, the hacker retains control over the stolen assets and is actively working to launder them.
This article is for informational purposes only and does not constitute investment advice.
