Fugitive Medjedovic Sent 2,900 ETH to Tornado Cash

Andean Medjedovic, a Canadian national indicted by the U.S. Department of Justice, transferred 2,900 ETH (about $6.8 million) to the cryptocurrency mixer Tornado Cash on April 29, 2026. The transfer is recorded on the blockchain and links funds tied to the indictments to a service sanctioned by U.S. authorities.

The DOJ charged Medjedovic in February 2025 with wire fraud, unauthorized damage to a protected computer, attempted Hobbs Act extortion and money laundering conspiracy. The indictment alleges the defendant drained roughly $48.8 million from Kyberswap on November 23, 2023, and about $16.5 million from Indexed Finance in 2021, for a total of roughly $65 million.

Tornado Cash was designated by the U.S. Treasury in 2022. The software pools and redistributes cryptocurrency to obscure transaction links between senders and recipients. Use of a sanctioned mixer by a person under federal money laundering charges can create additional legal exposure if the individual is apprehended.

Federal investigators from the FBI, the Internal Revenue Service and Homeland Security Investigations are working the case with assistance from Dutch law enforcement. No arrest has been reported and Medjedovic’s location remains unknown.

According to court filings, the alleged exploits used flash loans. A flash loan lets a user borrow large amounts of tokens without collateral as long as the loan is repaid within a single blockchain transaction. The indictment says Medjedovic used these loans to place rapid trades that caused automated market maker smart contracts to compute incorrect internal prices. Those incorrect prices then allowed withdrawals at values that did not reflect actual market rates.

On-chain records show continued activity in wallets connected to the accused, but they do not show whether assets have been converted to fiat currency or moved off-chain. Investigators previously tracked a pattern of gradual dispersals after the Kyberswap incident, including an 800 ETH transfer that followed that hack. The April 29 transfer is the largest single confirmed transfer to a mixer publicly linked to the case since those earlier dispersals. Publicly available tracking also indicates a remaining crypto portfolio tied to the Kyberswap exploit valued at about $29.8 million, though the full scope of converted or relocated assets is unclear.

The indictment also charges Medjedovic with attempted extortion, accusing him of demanding payment from a protocol in exchange for returning some stolen assets after the Kyberswap theft. Court filings describe the alleged attacks as among the ‘most technically sophisticated’ seen in decentralized finance.

Investigators continue to monitor on-chain movements and coordinate with international partners to trace and attempt recovery of assets connected to the indictments.