U.S. authorities charge Canadian teen math whiz in alleged US$65-million cryptocurrency scheme

U.S. authorities charge Canadian teen math whiz in alleged US-million cryptocurrency scheme

The U.S. Department of Justice has charged a 22-year-old Canadian math whiz in connection with what it calls “cryptocurrency hacking schemes” that allegedly netted him US$65-million in digital tokens.

Andean Medjedovic, who at 19 had already completed a master’s degree in mathematics at the University of Waterloo, is accused of exploiting vulnerabilities in decentralized financial platforms and then laundering the proceeds of those schemes, according to the indictment unsealed on Monday.

He is charged with one count of wire fraud, one count of unauthorized damage to a protected computer, one count of extortion, one count of money laundering conspiracy and one count of money laundering.

Mr. Medjedovic went into hiding in 2021, according to Ontario court documents.

U.S. authorities allege that on Oct. 14, 2021, Mr. Medjedovic stole US$16.5-million in digital tokens from two liquidity pools operated by Indexed Finance, a decentralized protocol run on the Ethereum blockchain platform. The so-called liquidity pools functioned similarly to a mutual fund or exchange-traded fund.

Mr. Medjedovic fraudulently obtained US$48.4-million of digital tokens from KyberSwap, another decentralized financial platform, in November, 2023, authorities allege.

The alleged schemes involved deceptive trading that exploited vulnerabilities in what are known as smart contracts – computer programs stored on a blockchain, or public ledger, that automatically execute transactions when predetermined conditions are met.

“The defendant Andean Medjedovic understood that his conduct circumvented the intended functioning of the KyberSwap Elastic liquidity pools,” the indictment reads. “Among other things … Medjedovic discussed a plan to ‘steal crypto,’ referred to the exploit as involving ‘glitch’ and ‘fake’ liquidity, and described the code for the exploit as a ‘rape.’ ”

None of the allegations have been proven in court.

Mr. Medjedovic is also accused of attempting to extort the victims of the KyberSwap exploit through a sham settlement proposal, and of laundering the proceeds of the alleged schemes through a series of transactions.

At one point, when a cryptocurrency service provider blocked one of Mr. Medjedovic’s transactions because it had traced the funds to the KyberSwap hack, Mr. Medjedovic threatened to contact authorities.

A customer-support agent at the service provider questioned the wisdom of Mr. Medjedovic alerting the authorities to the fact that he had “hacked kyber and stole users [sic] funds.”

“Yes, I am willing to alert the authorities,” Mr. Medjedovic wrote back, according to court documents. “Committing a crime against someone who may or may not be a criminal is still a crime.”

Eventually, to move some of his funds, Mr. Medjedovic enlisted the help of an individual who, unbeknownst to him, was an undercover law-enforcement official.

Cicada 137 LLC, a company that held cryptocurrency tokens on behalf of some investors in Indexed Finance, previously sued Mr. Medjedovic in Ontario, alleging that he had misappropriated millions of dollars in tokens.

At one point, after learning that the court had issued an order authorizing a search of Mr. Medjedovic’s cryptocurrency wallet passwords, he moved several million dollars’ worth of tokens. He stopped after being served with the actual order via e-mail, according to a court record.

Mr. Medjedovic attended at least one court hearing by video conference in 2021 – with his video off – before going into hiding. “This strikes me as the worst outcome for everyone involved,” Ontario judge Fred Myers wrote in January, 2022, after finding Mr. Medjedovic in contempt of court and issuing an arrest warrant. “It is no way for a 19-year-old who already holds a master’s degree in mathematics from a prestigious university program to commence his otherwise promising career.”

Court records note that Mr. Medjedovic may have received death threats, and that his parents were concerned for his well-being.

If convicted, Mr. Medjedovic faces a maximum penalty of 10 years in prison for the charge of unauthorized damage to a protected computer, and 20 years in prison for each of the other four counts.

Leave a Reply

Your email address will not be published. Required fields are marked *