This post is also available in: Bosnian
As his flight departed from Amsterdam’s Schiphol airport en route to Kuwait via Istanbul, Canadian crypto fugitive Andean Medjedovic was unaware that his globe-trotting lifestyle would soon be halted.
Just two weeks later, on December 11, 2023, Dutch authorities issued a European arrest warrant for the then 21-year-old, alleging he had pulled off a “sophisticated hack” that netted him $48 million US in cryptocurrency.
A native of Hamilton in the Canadian province of Ontario, Medjedovic graduated from high school at 14 and received a master’s degree in pure mathematics at 18; nine months after the arrest warrant was issued, he was arrested in Serbia.
Documents from extradition proceedings at the Higher Court of Belgrade obtained by Detektor and the CBC investigative documentary programme the fifth estate provide an extraordinary glimpse into the lifestyle and whereabouts of a young man with an alleged $65 million US in cryptocurrency burning a hole in his pocket and multiple countries seeking his arrest.
For four years, Medjedovic’s whereabouts have largely been a mystery to the public. Online speculation had been fuelled by his own statements to journalists, who reported his mentions of South America, unnamed islands and a jail “somewhere in Europe.”
Since disappearing in late 2021, according to statements made during the Serbian proceedings, he has travelled to Brazil, Dubai, Spain and elsewhere in Europe.
“He may be able to live large,” said Kyle Armstrong, a former FBI agent who works at blockchain intelligence firm TRM Labs. “However, to pay your rent, to buy a car, to travel, there’s not many places that are willing to accept cryptocurrency.”
Nevertheless, Armstrong added, “there are certain ways that if he has obfuscated his trail thus far, he may have cashed out some of his millions of dollars”.
Međedović, left, competed at the Ontario High School Chess Championship in 2016 and 2017. Photo: School Yearbook
Medjedovic is known in the realm of cryptocurrency for allegedly using his mathematical and computer programming prowess to drain millions of dollars from two crypto trading platforms, but also for engaging with victims and online observers in ways that buck the trend of crypto hackers, who often use the technology’s relative anonymity to quietly disappear with their spoils.
Shortly after millions in crypto were extracted from Vietnam-based KyberSwap, an exploit attributed to Medjedovic by American and Dutch authorities, the then unidentified attacker sent a publicly visible message to the firm: “Negotiations will start in a few hours when I am fully rested. Thank you.”
KyberSwap offered a 10 per cent bug bounty, a common practice in incidents such as this, where the perpetrator is asked to give back some portion of the crypto and in return is able to walk away consequence-free.
“He rejected that out of hand,” said TRM’s Armstrong.
Instead, the attacker demanded they be given complete control of the Kyber platform and offered to return 50 per cent to investors who had lost funds.
“I know this is probably less than what you wanted. However, it is also more than you deserve,” the attacker wrote.
“It was a ransom note,” Armstrong said, adding that this was the basis for the extortion charge against Medjedovic levelled by the U.S. Department of Justice in an indictment unsealed in early 2025.
The 2023 KyberSwap hack was executed from a hotel in The Hague that Medjedovic checked into using a fake Slovak passport, Dutch prosecutors say.
Pictures from the European arrest warrant for Međedović show a passport in the name of Luka Krajović that he allegedly used, as well as security camera footage of him in the hotel. Photo: Detektor
He “suddenly” departed the hotel the morning after the hack took place, they said, despite having already paid for the following month. By that point, he had been on the run for two years.
In late 2021, an Ontario judge issued a bench warrant for his arrest after he failed to participate in a civil case launched by an investor in a crypto platform called Indexed Finance that lost $16 million US.
The US Department of Justice said that Medjedovic “used similar means” to exploit both Kyber and Indexed. Both relied on hundreds of millions of dollars in borrowed funds that were used to execute trades and misrepresent the supply and demand of certain cryptocurrencies. Confused by the flurry of trading activity, the platforms allowed millions of dollars in assets to be purchased for next to nothing.
“So instead of his dollar-for-dollar exchange, he exchanges one dollar for many dollars worth of assets,” Armstrong said.
Contacted by Detektor and the fifth estate via email, Medjedovic replied: “I have only one defence to the allegations: ‘I’m a racist.’ Please include that, that’s all, thanks.”
Answer by Andean Međedović for CBC and Detektor. Photo: Detektor
Buried in computer code used to pull off the Indexed and KyberSwap attacks is a racist term for Black people, as well as a reference to sexual assault. A cryptocurrency address connected to Medjedovic also contains a well-known neo-Nazi symbol.
Regarding his arrest in Serbia and the Dutch extradition request, Medjedovic told the Higher Court of Belgrade: “I deny all the accusations that are stated in the extradition request and I do not wish to go to the Netherlands,” adding that “I would like to have children in Serbia and to achieve some more things here.”
‘I used the name Lorenzo’
“I stayed in the Netherlands at the time specified in the international arrest warrant. I was there for three months on a tourist trip,” Medjedovic told the Belgrade court regarding his whereabouts at the time of the 2023 KyberSwap hack.
“First I visited Bosnia, then Serbia, then Spain, and from Spain I went to the Netherlands,” he said, tracing his movements prior.
Dutch authorities say that during his time in the Netherlands an IP address connected to his hotel in the Hague was engaged in “suspicious activity” related to the hack.
Andean’s testimony before the court in Belgrade during the extradition hearing. Photo: Detektor
They also say Medjedovic identified himself for his flight departing the Netherlands with a Bosnian passport and that three days later, just two days before his 21st birthday, Medjedovic was travelling to Sarajevo using a Slovak passport.
It is unclear if he travelled or stayed put between his November 26, 2023, arrival in Sarajevo and an apparent stay in the United Arab Emirates the following year.
Medjedovic told the court that prior to his arrest in Serbia he “was in Dubai for four months, where I used the name Lorenzo”. He also said he used that name to book an apartment in Belgrade.
“When I stayed in hotels, I used fake names and fake passports, specifically in the Netherlands I used a fake Slovak passport, and I did this to keep my privacy because when trading cryptocurrencies, you often become the target of criminals,” he said.
In its indictment, the US alleges that Medjedovic maintained files in which he wrote “make new bank account under fake ID”, and “order documents online (Russian + Brazil + American citizen).”
It also says Medjedovic “documented his plans and methods to launder the criminal proceeds in a file titled: “moneyMovementSystem.” The file contained a step-by-step “operating procedure” for moving cryptocurrency through a mixer, a tool to obfuscate where cryptocurrency is being moved to and where it has come from.
While Medjedovic was sitting in the Belgrade District Prison, more than $6 million US worth of crypto connected to his alleged exploits was moved into a cryptocurrency mixer called Tornado Cash.
Dutch authorities have charged Medjedovic with money laundering, and specifically highlight his alleged use of Tornado Cash prior to his arrest.
‘Believed to be at large in Bosnia’
After 105 days in Serbian custody, Medjedovic was released on November 22, 2024.
In its decision denying the Dutch extradition request, the High Court of Belgrade stated that Dutch prosecutors had not sufficiently proven Medjedovic was the perpetrator of the crimes and that even if he was, those crimes carried too light a sentence domestically to be worthy of extradition.
Previously unreported filings from the US Department of Justice show it was watching his next moves, and that he may have quickly left Serbia for neighbouring Bosnia and Herzegovina.
“Defendant is believed to be at large in Bosnia,” the DOJ wrote on January 17, 2025, two months after his release.
Medjedovic’s parents have Bosnian roots and still have close relatives in the country.
Emails between Medjedovic and his father show him asking for his parents’ Bosnian identification documents so that he could “get citizenship in another country”.
The fifth estate and Detektor obtained records showing that a few months after that email chain started, Medjedovic listed an address in Ilidza, a suburb of Bosnia’s capital, Sarajevo, in an application for a passport.
Those emails surfaced as part of the civil case against him in Ontario launched by an investor in the cryptocurrency firm Indexed Finance, which lost $16 million US in October 2021.
Regarding that civil case, Medjedovic told the Serbian court: “The procedure was initiated three years ago at the time I was in Brazil, so in the last three years I have not gone to Canada at all.”
“There are some concerns”
According to a report in The Globe and Mail in 2016, then 13-year-old Medjedovic was in a twelfth-grade data management class at school in Hamilton and had completed grade nine and 10 mathematics while still in elementary school.
A local television broadcast from 2017 described Medjedovic as the youngest student to ever graduate from high school in the city’s public school district.
“I don’t really feel any different from the regular high school student,” he said in the report, while his father said of his race through school: “There are some concerns, but we hope for [the] best”.
After four years at the University of Waterloo, Medjedovic had a master’s degree in pure mathematics. But already in school, he was leaving an online footprint that Indexed Finance and online sleuths would use to connect him to the 2021 attack.
The world of cryptocurrency is generally pseudonymous, but publicly visible. This means that anyone can see that address A sent Bitcoin to address B, but it’s not immediately apparent who A and B are.
When Indexed Finance was drained of funds, the firm initially knew only that a specific cryptocurrency address was involved.
Following a trail of digital breadcrumbs detailed in a blog post, sleuths came to an account on a computer programming website called Github in the name mtheorylord.
Mtheorylord had a post titled “Grade 12 Project,” which was found to have been made using an email address from the Hamilton-Wentworth District School Board.
Also, on the Wikipedia page for Reach for The Top, a quiz show for Canadian high school students, the mtheorylord account had added an alumnus. Just below former Canadian Prime Minister Stephen Harper, the entry had been edited to include “Andean Medjedovic — notable mathematician.”
“We joked years later whether cutting him from the Reach team was the start of his villain arc,” said Luka Obrovac, who helped coach the Reach for The Top team at Westmount Secondary School when Medjedovic was a student in 2016.
“He wasn’t a team player,” said Obrovac. “He stepped on a lot of toes,”
‘He needs to be perfect’
In December 2025, at the culmination of a six-month investigation, the fifth estate and Detektor visited the building outside Sarajevo which Medjedovic had listed as his address in 2022.
Detektor reporter sent Medjedovic’s photo to a building representative, who said the police had also been looking for him just a few months prior.
“They asked the same as you,” the representative said by phone. “They brought a picture and asked if I knew this guy by chance, if I had seen him. I had not seen him.”
The residential complex in Ilidža where Međedović was registered. Photo: Detektor
Police sources confirmed that Bosnian police officers and Dutch prosecutors had tried to arrest Medjedovic.
The Bosnian State Investigation and Protection Agency said only that it had acted on a Bosnian court order. The Court of Bosnia and Herzegovina directed Detektor to the state Prosecutor’s Office, which said there was no case open against Medjedovic.
However, at the level of the Sarajevo Canton, one of 10 cantons in Bosnia’s Federation entity, prosecutors said that on January 12, 2024, the Federation Police Administration informed prosecutors about Medjedovic’s stay in Bosnia and possible identity fraud. The prosecution said it asked for more information and for police to investigate further. The entity’s interior minister, Ramo Isak, said he was unable to share any more details.
Then, in the final days of 2025, millions of dollars in cryptocurrency connected to Medjedovic, which had been sitting silently for nearly 440 days, were moved on the blockchain.
The funds had been swapped from a variety of cryptocurrencies into Ethereum, which signalled that it could be moving to a mixer like Tornado Cash, according to some online observers.
However, as of the publishing of this article, the funds have not since moved.
“He needs to be perfect,” Kyle Armstrong said. “From here until eternity, he needs to be perfect in obfuscating the proceeds of this exploit which are being tracked.”
While the average observer is unable to trace cryptocurrency through a tool like Tornado Cash, software from companies like TRM Labs makes it possible.
“You’re not doing yourself any favours with the court, with the prosecutors, running for as long as he’s been running,” said Ari Redbord, global head of policy with TRM.
“The reality is that at some point you come in and you fall on your sword and potentially do everything you can to ultimately help the government,” he said, which could include returning the funds and taking responsibility for the schemes.
If he doesn’t cooperate, “he could do more than 10 years,” in prison, Redbord said.
Contributors: Enes Hodžić and Miloš Katić
