- Wallets tied to the KyberSwap exploit sent $24.88M through Tornado Cash in new moves.
- Repeated 100 ETH transfers suggest a coordinated laundering pattern tied to the case.
- U.S. charges remain active as Medjedovic-linked funds keep moving across wallets.
Blockchain platform Arkham data shows fund movements tied to KyberSwap exploiter Andean Medjedovic. Wallets linked to the case have now sent a total of $24.88 million through Tornado Cash.
The transfers followed a clear pattern on-chain. The wallet sent repeated withdrawals of exactly 100 ETH to the Tornado Cash Router address. Several of the transfers appeared within seconds or minutes of each other.
However, the same wallet still holds more than $29 million in assets. Its largest balance is 11,861 ETH, valued at about $27.58 million. It also holds 796.39 wstETH worth about $2.28 million.
Smaller balances in stablecoins and other tokens were also visible. The structure of the transfers drew attention because the amounts and timing were highly uniform.
KyberSwap Case Expands With Charges and New Moves
Analyst Specter said in an X post that Medjedovic stole $65 million from two protocols between 2021 and 2023. The cited protocols were KyberSwap and Indexed Finance.
U.S. prosecutors have accused Medjedovic of exploiting weaknesses in both protocols. They allege that he borrowed large sums, manipulated trading systems, and then withdrew funds at inflated prices.
The U.S. Department of Justice unsealed its indictment on February 3, 2025. The filing charged Medjedovic with five counts. The indictment marked a major step in the U.S. case.
Before that filing, Medjedovic had already faced legal trouble in Europe. He was arrested in Serbia in 2024 on a warrant from the Netherlands. The Higher Court in Belgrade released him after 90 days, citing insufficient evidence.
His status remained unclear after that release. No public confirmation of a new arrest has followed since then. His whereabouts also remain unknown.
Medjedovic Resumes Tornado Cash Moves
On February 20, 2026, Medjedovic was named in a reported effort to seek a U.S. presidential pardon through JM Burkman & Associates. The filing alleged a $300,000 payment to the lobbying firm.
Two months later, the wallet activity resumed. The funds again moved through Tornado Cash. Tornado Cash remains central to the case because it makes tracing harder. Once funds pass through such a service, their source becomes more difficult to follow.
Investigators had previously pointed to mixers, swaps, and cross-chain bridges as methods used to obscure the trail of stolen assets.
However, Blockchain activity indicates that wallets tied to the KyberSwap exploit are still moving funds. The U.S. criminal case remains active, and there is no public confirmation that Medjedovic has been taken into custody.
Related: North Korea Stole 76% of the April 2026 Crypto Hacks in Just Two Attacks
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
