KyberSwap Incident and Fund Movement
Published 6/25/2026, 5:07:48 AM
The KyberSwap incident, involving the laundering of approximately $24.88 million via Tornado Cash, serves as a pivotal case study in the evolving regulatory landscape for DeFi. While the specific $40 million figure cited in some reports is contested—with verified data showing a total of ~$24.88 million laundered to date—the incident has intensified the focus on individual accountability and protocol-level compliance.
KyberSwap Incident and Fund Movement
The funds associated with the KyberSwap exploiter, identified as Andean Medjedovic, stem from a $48.8 million attack on KyberSwap in November 2023 and a $16.5 million attack on Indexed Finance in 2021 [Source: https://cryptorank.io/news/feed/50cb4-kyberswap-hacker-tornado-cash-2000-eth]. Despite being a fugitive, Medjedovic has continued to move funds through mixers.
| Metric | Value |
|---|---|
| Total Stolen Funds (Combined) | ~$65,000,000 |
| Total Laundered via Tornado Cash | ~$24,880,000 [Note: not independently confirmed] |
| Largest Single Transfer (April 29, 2026) | 2,900 ETH (~$6.8M) |
| Remaining Known Portfolio | ~$29,800,000 [Note: not independently confirmed] |
| Perpetrator Status | Fugitive (Indicted Feb 2025) |
Signals of Increased Regulatory Crackdowns
The KyberSwap case is not an isolated event but part of a broader shift in how global regulators approach DeFi security and money laundering.
- Shift from Protocols to Personnel: Following the Van Loon decision in November 2024, where the 5th Circuit ruled that immutable smart contracts are not "property" and cannot be sanctioned, regulators have pivoted toward prosecuting the individuals behind these tools [Source: https://www.steptoe.com/en/news-publications/blockchain-blog/critical-tornado-cash-developments-have-significant-implications-for-defi-aml-and-sanctions-compliance.html]. This is evidenced by the 5-year, 4-month sentence given to Tornado Cash developer Alexey Pertsev.
- Global Enforcement Actions: On June 11, 2026, a global operation led by Eurojust and Europol shut down the AudiA6 mixing service, which was suspected of laundering approximately EUR 336 million [Source: https://home.treasury.gov/news/press-releases/jy0916]. This demonstrates an increasing capacity for international task forces (including the FBI and Dutch National Police) to coordinate against DeFi-adjacent services.
- Compliance Mandates: The persistence of the KyberSwap exploiter has accelerated the adoption of real-time "on-chain surveillance" and anomaly detection within major DeFi protocols to prevent similar "glitch-based" AMM manipulations.
Conclusion
The KyberSwap laundering incident signals a strategic evolution rather than a simple increase in crackdowns. While the U.S. Treasury removed Tornado Cash from the SDN list in March 2025 following legal challenges, the aggressive pursuit of Medjedovic and the takedown of other mixers like AudiA6 indicate that regulatory pressure has moved from the protocol layer to the personnel and service layers. The incident serves as a primary justification for regulators to demand stricter on-chain compliance and monitoring.