Timeline of Fund Movements
Published 6/25/2026, 3:25:09 AM
The KyberSwap attacker, identified by the U.S. Department of Justice as 21-year-old Canadian national Andean Medjedovic, has systematically laundered approximately $40 million (16,100 ETH) through Tornado Cash [Source: https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi]. This represents over 80% of the $48.8 million stolen during the November 2023 exploit of KyberSwap Elastic pools [Source: https://phemex.com/news/article/kyberswap-exploiter-launders-additional-2000-eth-via-tornado-cash-90629].
Timeline of Fund Movements
The laundering process has been characterized by long periods of dormancy followed by aggressive bursts of activity.
| Date | Action | Amount |
|---|---|---|
| Nov 22, 2023 | Initial Exploit of KyberSwap Elastic pools | ~$48.8 Million |
| Nov 23, 2023 | Partial return of funds to protocol | ~$4.7 Million |
| March 15, 2025 | First major post-exploit Tornado Cash deposit | 1,600 ETH (~$3.72M) [Note: not independently confirmed] |
| June 2025 | Secondary laundering phase | 2,000 ETH |
| April 29, 2026 | Largest single laundering move recorded | 2,900 ETH (~$6.8M) |
| Total Laundered | Cumulative movement through Tornado Cash |
Mechanics of the $40M Movement
The attacker utilized specific Tornado Cash features to obfuscate the trail of stolen assets:
- Fixed Denomination Pooling: To move $40M, the attacker executed hundreds of deposits, primarily into the 100 ETH pools. This strategy mixes the stolen funds with other high-value transactions to maximize the "anonymity set" [Source: https://phemex.com/news/article/kyberswap-exploiter-launders-additional-2000-eth-via-tornado-cash-90629].
- Relayer Usage: The attacker employed third-party relayers for withdrawals. Relayers submit the withdrawal transaction to the blockchain and pay the gas fees, ensuring there is no direct on-chain link (via gas funding) between the attacker's original wallet and the new destination wallet.
- Smurfing and Timing: Large sums were broken into smaller "chunks" and moved after significant delays to evade automated detection systems and timing analysis used by blockchain investigators.
Traceability and Legal Status
Despite the use of privacy tools, blockchain analytics firms like PeckShield have maintained visibility on the movement of these funds by "fingerprinting" the attacker's behavior across multiple fresh wallets [Source: https://phemex.com/news/article/kyberswap-exploiter-launders-additional-2000-eth-via-tornado-cash-90629].
Medjedovic was charged by the DOJ in February 2025 with wire fraud and money laundering conspiracy related to the theft of approximately $65 million from both KyberSwap and Indexed Finance [Source: https://www.justice.gov/usao-edny/pr/canadian-national-charged-stealing-approximately-65-million-cryptocurrency-two-defi]. While the funds have been moved through Tornado Cash, the specific withdrawal addresses remain largely undisclosed in public law enforcement records.
A significant portion of the movement reportedly occurred following a March 2025 Fifth Circuit Court ruling regarding the U.S. Treasury's authority over smart contracts, though the exact impact of this ruling on the attacker's timing is not independently confirmed [Note: not independently confirmed].