Andean Medjedovic: Charged Over $65M in DeFi Raids, Now Seeking a Trump Pardon

On 20 February 2026, a Washington lobbying firm filed papers with the US Justice Department declaring a new foreign client and a single goal: "achieving a presidential pardon." The client was Andean Medjedovic, a 23-year-old maths prodigy from Hamilton, Ontario, charged a year earlier by the same department with taking about $65 million from two crypto trading platforms. According to the filings, reported by CBC News, he paid a $300,000 retainer. His whereabouts are not publicly known.

Medjedovic is charged, not convicted. A five-count indictment unsealed on 3 February 2025 in Brooklyn, in the Eastern District of New York, accuses him of wire fraud, unauthorised damage to a protected computer, attempted Hobbs Act extortion, money laundering conspiracy and money laundering. The computer count carries up to 10 years in prison and each of the others up to 20. He has never appeared in a US court; his lobbyists say he merely traded.

Indexed Finance lost about $16 million on 14 October 2021, when Medjedovic was 18. KyberSwap lost about $48 million on 22 November 2023. Both belong to decentralised finance, or DeFi: trading and lending services run by software instead of by a company's staff.

©CMZ chart. Data: US Department of Justice, Indexed Finance, KyberSwap

A vending machine with a pricing bug

DeFi runs on smart contracts: programs on a blockchain that hold deposits and move money by themselves under fixed rules. Investors put tokens into shared pools, rather like buying into an index fund, and earn fees when others trade against them.

Think of a vending machine that works out its own prices. If the pricing formula has a bug, someone who understands it can feed in coins in a strange order until the machine believes a chocolate bar costs a penny, then empty it. "Exploiting a smart contract" means exactly that. Nothing is broken into; the machine's own maths is turned against it.

According to the Justice Department, Medjedovic borrowed hundreds of millions of dollars in tokens and used them for "deceptive trading" that he knew would cause the contracts to "falsely calculate key variables," letting him withdraw investor money "at artificial prices." The borrowing came through flash loans, taken out and repaid within seconds in a single transaction.

Indexed Finance ran index pools called DEFI5 and CC10, small baskets of tokens that worked like exchange-traded funds. Security analysts said the flood of borrowed tokens made a pool undervalue itself, so new pool shares could be created cheaply and cashed in for the real tokens underneath.

KyberSwap, a Vietnam-based exchange run by Kyber Network, fell to a subtler flaw. Its Elastic pools rounded a liquidity calculation the wrong way at the edge of a price range. By pushing the price to a point where the pool held almost nothing, the attacker made the contract count the same money twice. Kyber's post-mortem put the main attacker's take at about $48.7 million; copycat bots took roughly $6.6 million more.

"So I can steal crypto, lol"

Two months before one of the attacks, the indictment says, he wrote that he had been working on a breakthrough "so I can steal crypto, lol," and called some of the planned results "fake" and a "glitch." His files included a note reading "Find time to Strike!", a "POST-EXPLOITATION" plan and a list weighing "Going On the run" against the payoff. After the Indexed attack he allegedly wrote that he had "accidentally doxxed" himself, exposing his own identity: "I may be on the run forever now."

Indexed says it linked a username from the attack to a Hamilton school board email address and to a Wikipedia edit listing "Andean Medjedovic, notable mathematician" among a quiz show's alumni. He had finished high school at 14, the youngest graduate on record in the Hamilton-Wentworth District School Board, and held a master's degree in pure mathematics from the University of Waterloo by 18.

After the KyberSwap attack, the then-anonymous attacker posted: "Negotiations will start in a few hours when I am fully rested. Thank you." Kyber offered the usual 10 per cent bounty. Instead, the indictment says, he demanded complete control of KyberSwap and of its DAO, the token holders' body that votes on how the platform is run, much like a shareholder meeting, in return for giving back half the money. "I know this is probably less than what you wanted. However, it is also more than you deserve," he wrote. That proposal is the basis of the extortion count.

Code is law, and why prosecutors reject it

The case made for Medjedovic is the old crypto idea that code is law: if the program allowed a trade, the trade was allowed. He has hinted at it rather than spelled it out. "You were out-traded. There is nothing you can do about that... Such is crypto," he posted on Twitter, according to DL News. His lobbyists' filing says he "identified an ingenious way to operate within the boundaries set by" the platforms "and executed standard permissible trades for profit."

The indictment answers in its wording: "deceptive trading" that made the contracts "falsely calculate." On a stock exchange, trading to fool the pricing system and then cashing in is manipulation; prosecutors say a contract is no different. Benjamin Bathgate, a Toronto lawyer acting for an Indexed investor, told CBC that if markets worked the way Medjedovic claims, "it would be the Wild West, with no investor being safe from being the next target." The extortion and laundering counts do not depend on the argument at all.

The closest test so far went both ways. Avraham Eisenberg drained more than $100 million from Mango Markets in October 2022 and called it "a highly profitable trading strategy." A Manhattan jury convicted him in April 2024 of commodities fraud, manipulation and wire fraud. On 23 May 2025 Judge Arun Subramanian threw out all three, chiefly because the case was brought in the wrong district, and the wire fraud count also because Mango had no terms of service banning manipulation, so there was no false statement. The ruling did not endorse code is law, but it showed the theory is hard to land.

On the run, then the lobbyists

His travels are known mostly from court files obtained by CBC's the fifth estate and the Balkan Investigative Reporting Network (BIRN). In 2021 Cicada 137 LLC, an Indexed investor, sued him in the Ontario Superior Court of Justice; he refused orders to hand over the tokens and Justice Fred Myers issued a warrant for his arrest in December 2021. He told a Serbian court he had since been to Brazil, Bosnia, Spain and the Netherlands, and spent four months in Dubai under the name Lorenzo.

Dutch prosecutors say the KyberSwap attack was run from a hotel in The Hague, where he checked in on a fake Slovak passport. The Netherlands issued a European arrest warrant on 11 December 2023 and Interpol a Red Notice. Serbian police arrested him on arrival in Belgrade on 9 August 2024. "I deny all the accusations that are stated in the extradition request and I do not wish to go to the Netherlands," he told the Higher Court in Belgrade. After 105 days the court refused extradition, finding the Dutch had not proved he was the perpetrator and that the offences carried too light a sentence. He walked out on 22 November 2024.

The US Justice Department wrote on 17 January 2025 that he was "believed to be at large in Bosnia." BIRN's sources say Bosnian police and Dutch prosecutors later tried and failed to arrest him there.

Then came JM Burkman & Associates, the firm of Jack Burkman and Jacob Wohl, which registered under the Foreign Agents Registration Act. Wohl told CBC that Medjedovic is "a very brilliant young man" and that "people went in and traded and the price action reflected that. That's a very different thing from an exploit." He said the first aim was for the Justice Department to drop the charges, failing which "there's only one person that can grant the pardon." CBC noted that Wohl has himself pleaded guilty to fraud charges in Ohio and California and no contest to election-law felonies in Michigan.

President Donald Trump has pardoned crypto figures before, including Silk Road founder Ross Ulbricht in January 2025 and Binance founder Changpeng Zhao in October 2025. As of 1 October 2026 there is no public record of a pardon for Medjedovic, of the charges being dropped, or of his arrest.