Most crypto hackers try to disappear. Andean Medjedovic, the Canadian national U.S. prosecutors accuse of stealing roughly $65 million from two DeFi protocols, is doing the opposite: reporting indicates his camp has hired a Washington, D.C. lobbying firm specifically to pursue a U.S. presidential pardon for charges he hasn't even been tried on yet.

The underlying case

U.S. prosecutors indicted Medjedovic in February 2025 on charges tied to two separate incidents: an exploit of Indexed Finance and a roughly $48 million exploit of KyberSwap in 2023, together alleged to total about $65 million. What made both cases hard to prosecute under traditional fraud statutes is that neither involved stolen credentials, malware, or a broken lock in any conventional sense — prosecutors allege Medjedovic instead manipulated the pricing and liquidity logic that these protocols' smart contracts rely on, using a sequence of transactions that were each, individually, permitted by the code. That's the recurring legal puzzle at the center of DeFi exploits: when a smart contract does exactly what its code says to do, but the code itself can be gamed, is that theft or is that just using the system as written? Prosecutors clearly came down on the former.

Arrested, released, and gone

Medjedovic was arrested in Belgrade, Serbia in 2024 on the strength of the U.S. indictment and an Interpol Red Notice. A Serbian court then rejected the extradition request and released him. As of 2026, his current whereabouts are unknown, though authorities believe he has left Serbia entirely — leaving him a fugitive from a case that, on paper, remains fully active.

The pardon push

In March 2026, reporting from CBC News and Balkan Insight indicated Medjedovic had retained the lobbying firm JM Burkman & Associates specifically to pursue a presidential pardon through contacts in the Trump administration, according to disclosure filings referenced in that reporting. The current status of that lobbying effort is unclear, and there's no public indication a pardon has been granted or is imminent. What is notable is the strategy itself: rather than fighting extradition indefinitely or attempting a negotiated surrender, Medjedovic's team appears to be betting that a clemency request can resolve the case entirely, bypassing a trial altogether.

Why prosecutors treat this differently than a bridge hack

Compare this case to the string of exchange and bridge hacks ChainBrief has covered this year — Bitget, Coldcard, Liquid Network — and the contrast is instructive. Those were attacks against systems: stolen keys, forged wallet instructions, weak entropy. Medjedovic's alleged conduct is different in kind — it's an attack against economic logic, executed entirely through transactions the protocol itself accepted as valid. DeFi's foundational pitch is that code is the final arbiter — "code is law" — and cases like this are the sharpest test of whether that principle survives contact with a federal prosecutor who disagrees.

Why it matters

This case sits at the center of an unresolved question DeFi still hasn't answered for itself: is exploiting a smart contract's own published logic a crime, a tort, or just aggressive trading? U.S. prosecutors have made their answer clear by indicting Medjedovic under ordinary computer-fraud and wire-fraud statutes, treating a DeFi exploit exactly like they would treat a bank heist. Whether a pardon lobbying campaign succeeds or fails, the case itself is a real-world test of how far "the code allowed it" gets you as a legal defense — and every DeFi protocol shipping pricing or liquidity logic today is, whether its developers realize it or not, writing the next test case. It's also a reminder that a fugitive's legal exposure doesn't end at a border: an active federal indictment and Interpol Red Notice mean Medjedovic's ability to travel, bank, or operate openly anywhere with U.S. extradition cooperation stays constrained indefinitely, pardon campaign or not, which is its own form of consequence even absent a conviction. And for the DeFi industry watching from the sidelines, the case is a preview of a legal standard rather than an isolated incident: prosecutors treating an on-chain, code-permitted transaction sequence as straightforward theft sets a precedent other exploiters, and the protocols they target, will have to reckon with regardless of how this particular case resolves.

Further reading

Frequently asked

What did Medjedovic actually do, technically?

Prosecutors allege he manipulated the pricing and liquidity mechanisms of two DeFi protocols — Indexed Finance and KyberSwap — through carefully sequenced, individually legal on-chain transactions that exploited how those protocols' smart contracts calculated asset prices, rather than through any traditional hacking technique like stolen credentials or malware.

Is he currently in custody?

No. He was arrested in Belgrade, Serbia in 2024, but a Serbian court rejected the U.S. extradition request and he was released. As of 2026 his whereabouts are unknown, though authorities believe he has since left Serbia — which is part of why an Interpol Red Notice remains active against him.

Does a pending pardon request mean the charges are being dropped?

No — a pardon lobbying effort and a criminal indictment are entirely separate tracks. The federal charges remain active regardless of any lobbying campaign, and a pardon (which only a sitting president can grant, and only for federal crimes) would not erase the underlying allegations or any parallel foreign legal exposure.