Hack and Laundering Overview
Published 6/25/2026, 2:23:42 AM
The claim that the KyberSwap hacker laundered $40 million through Tornado Cash is currently unverified and likely an overstatement. While the hacker has systematically moved millions through the mixer, confirmed on-chain data as of June 2026 indicates the total laundered amount is approximately $24.88 million [Source: https://onchainattack.org/].
Hack and Laundering Overview
The exploit occurred in November 2023, targeting KyberSwap’s Elastic pools through a sophisticated price manipulation attack. The hacker, identified by the U.S. Department of Justice as Canadian national Andean Medjedovic, stole approximately $48.8 million from KyberSwap across six blockchains [Source: https://onchainattack.org/].
| Metric | Data Point |
|---|---|
| Total Stolen (KyberSwap) | $48.8 Million |
| Confirmed Laundered (Tornado Cash) | $24.88 Million |
| Remaining in Hacker Wallet | ~$29.8 Million |
| Most Recent Major Transfer | 2,900 ETH (~$6.8M) on April 29, 2026 |
| Laundering Method | Automated 100 ETH batches |
| Legal Status | Indicted Feb 2025; Fugitive status |
Analysis of the $40M Claim
The $40 million figure may stem from the total amount stolen ($48.8M) rather than the amount successfully processed through Tornado Cash.
- Ongoing Activity: The hacker continues to move funds. In April 2026, a significant transfer of 2,900 ETH (valued at roughly $6.8 million) was sent to Tornado Cash, bringing the confirmed total to the current $24.88 million mark [Source: https://onchainattack.org/].
- Remaining Assets: A substantial portion of the stolen funds remains in the primary exploit address (
0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913). As of June 2026, this wallet still holds approximately 11,861 ETH and 796 wstETH, totaling nearly $30 million in value [Source: https://onchainattack.org/]. - Systematic Execution: On-chain analysis shows the hacker uses automated scripts to send exactly 100 ETH per transaction to the Tornado Cash Router, often executing multiple transfers within seconds of each other to obfuscate the trail [Source: https://onchainattack.org/].
Legal and Political Context
The laundering activity is a primary component of the money laundering conspiracy charges filed against Medjedovic. Interestingly, in February 2026, the hacker reportedly paid $300,000 to a lobbying firm, JM Burkman & Associates, in an attempt to secure a U.S. presidential pardon while remaining a fugitive, likely in Serbia [Source: https://onchainattack.org/].
Conclusion: While the hacker has successfully laundered nearly $25 million, the $40 million figure is not supported by current blockchain records. Approximately $30 million in stolen assets remains in the hacker's known wallets, suggesting that while laundering is ongoing, it has not yet reached the $40 million threshold.