KyberSwap Hacker Moves Millions to Tornado Cash

Background and Context

Recent blockchain data shows renewed activity from wallets tied to Medjedovic. According to Arkham Intelligence, the exploiter has transferred between 1,600 and 2,900 ETH into Tornado Cash. These transactions are worth several million dollars and follow months of relative inactivity after his 2025 indictment.

Previously, he also conducted a $2 million token dump in December 2025. Therefore, this timing suggests a calculated attempt to move and hide remaining funds while he continues to evade authorities.

Moreover, this behavior is not new. Court filings show that Medjedovic built a structured laundering system using mixers, bridge protocols, and fake exchange identities. After the 2021 Indexed Finance exploit, he began using these methods extensively. Notably, he even routed over $6 million through Tornado Cash while detained in Serbia in late 2024. As a result, his actions reflect a long-term, deliberate strategy to evade tracking.

Meanwhile, the original KyberSwap exploit had immediate consequences. The attack drained nearly $48.8 million from 77 liquidity pools across six blockchains. Consequently, the platform’s total value locked dropped by over 90% within hours. Kyber Network then cut about 50% of its workforce and launched recovery efforts, reclaiming around $5.7 million.

Ongoing Laundering Efforts and Law Enforcement Response

Currently, these transfers represent the largest public movement of Kyber-linked funds since late 2025. Analysts note that the exploiter is using intermediary wallets before routing funds into Tornado Cash. This method increases transaction complexity and reduces traceability.

In parallel, U.S. prosecutors have already charged Medjedovic with money laundering conspiracy. Authorities in the Netherlands previously flagged his use of Tornado Cash, while U.S. filings detail attempts to bypass frozen bridge transactions. In one instance, he allegedly offered $80,000 to an undercover agent to unlock funds.

However, enforcement challenges remain significant. Serbian authorities arrested him in Belgrade in August 2024 but later released him after rejecting a Dutch extradition request. As of early 2026, reports suggest he may have moved to Bosnia, although his exact location remains unknown. Therefore, cross-border legal limitations continue to slow progress.

Did He Get Away With It? Implications for DeFi and Victims

At present, it remains unclear whether Medjedovic will face justice. The indictment includes five serious charges, such as wire fraud, unauthorized system damage, attempted extortion, and money laundering. If convicted, he could face decades in prison.

However, his ability to operate across jurisdictions, combined with the use of fake identities and advanced laundering techniques, complicates enforcement. Consequently, this case has become a major test for global crypto regulation and law enforcement coordination.

For victims, the situation remains unresolved. Users affected by both exploits continue to seek restitution, yet ongoing laundering efforts reduce the likelihood of full recovery.