Fake passports, $65M US and an Interpol Red Notice: Canadian crypto fugitive vanishes after arrest in Serbia

As his flight departed from Amsterdam’s Schiphol airport en route to Kuwait via Istanbul, Canadian crypto fugitive Andean Medjedovic was unaware that his globe-trotting lifestyle would soon be halted.

Just two weeks later, on Dec. 11, 2023, Dutch authorities issued a European arrest warrant for the then 21-year-old, alleging he had pulled off a “sophisticated hack” that netted him $48 million US in cryptocurrency. 

The Hamilton native who had graduated from high school at 14 and received a master’s degree in pure mathematics at 18 was arrested nine months later in Belgrade, Serbia, where he quickly appeared before a judge.

Documents from extradition proceedings at the Belgrade Higher Court obtained by the fifth estate and the Balkan Investigative Reporting Network (BIRN) provide an extraordinary glimpse into the lifestyle and whereabouts of a young man with an alleged $65 million US in cryptocurrency burning a hole in his pocket and multiple countries seeking his arrest.

For four years, Medjedovic’s whereabouts have largely been a mystery to the public. Online speculation had been fuelled by his own statements to journalists, who reported his mentions of South America, unnamed islands and a jail “somewhere in Europe.”

Since disappearing in late 2021, according to translated statements made during the Serbian proceedings, he has travelled to Brazil, Dubai, Spain and elsewhere. 

“He may be able to live large,” said Kyle Armstrong, a former FBI agent who works at blockchain intelligence firm TRM Labs. 

“However, to pay your rent, to buy a car, to travel, there’s not many places that are willing to accept cryptocurrency,” he said. But “there are certain ways that if he has obfuscated his trail thus far, he may have cashed out some of his millions of dollars.” 

Medjedovic competed in the Ontario High School Chess Championships in 2016 and 2017. (HWDSB Educational Archives)

Medjedovic is known in the cryptocurrency space for allegedly using his mathematical and computer programming prowess to drain millions of dollars from two crypto platforms. He gained even more notoriety for subsequently engaging with victims and online observers in ways that buck the trend of accused crypto hackers, who often use the technology’s relative anonymity to quietly disappear with their spoils. 

Shortly after millions in crypto were extracted from Vietnam-based KyberSwap, a heist attributed to Medjedovic by American and Dutch authorities, the then unidentified attacker sent a publicly visible message to the firm: “Negotiations will start in a few hours when I am fully rested. Thank you.”

Watch the full documentary, “Canada’s Crypto Fugitive,” from the fifth estate on YouTube or CBC-TV on Friday at 9 p.m.

KyberSwap offered a 10 per cent bug bounty, a common practice in incidents such as this, where the attack is cynically reframed as a test of the platform’s security. The perpetrator is asked to give back some portion of the crypto and in return is able to walk away consequence-free.

“He rejected that out of hand,” said TRM’s Armstrong. 

Instead, the attacker demanded they be given complete control of the Kyber platform and offered to return 50 per cent to investors who had lost funds. 

“I know this is probably less than what you wanted. However, it is also more than you deserve,” they wrote. 

“It was a ransom note,” Armstrong said, adding that this was the basis for the extortion charge against Medjedovic levelled by the U.S. Department of Justice in an indictment unsealed in early 2025.

According to the Dutch extradition request, the hack was executed from a hotel in The Hague, which, they say, Medjedovic checked into using a fake Slovak passport. 

These grainy images were included in a European arrest warrant for Medjedovic and show a passport in the name of Luka Krajovic he allegedly used and security camera footage of him at a hotel. (District Public Prosecutor’s Office, The Hague)

Medjedovic “suddenly” departed the hotel the morning after the hack took place, they said, despite the fact that he had paid for the following month’s accommodation.

By that point, he had already been on the run for two years. In late 2021, an Ontario Superior Court judge issued a bench warrant for his arrest after he failed to appear in a civil case launched against him by an investor in a crypto firm called Indexed Finance. 

Medjedovic allegedly, at age 18, exploited vulnerabilities in Indexed’s programming and made off with $16.5 million U.S. 

U.S. authorities said Medjedovic “used similar means” to exploit Kyber and Indexed. Both schemes relied on hundreds of millions of dollars in borrowed funds that were used to execute trades and misrepresent the supply and demand of certain cryptocurrencies. Confused by the flurry of trading activity, the platforms allowed millions of dollars in assets to be purchased for next to nothing.   

“So instead of his dollar-for-dollar exchange, he exchanges one dollar for many dollars worth of assets,” Armstrong said.

The Globe and Mail reported in 2016 that Medjedovic, shown here in a school yearbook, completed Grade 9 and 10 math while still in elementary school. (HWDSB Educational Archives)

The fifth estate emailed Medjedovic to request a comment on the allegations against him.

He replied: “I have only one defence to the allegations: ‘I’m a racist.’ Please include that, that’s all, thanks.”

Buried in the computer code used to pull off the Indexed attack is a racist slur for Black people, and in Kyber’s a comparison of the theft to sexual assault. A cryptocurrency address connected to Medjedovic also contains a well known neo-Nazi symbol. 

Regarding his arrest in Serbia and the Dutch extradition request, Medjedovic told the Belgrade Higher Court: “I deny all the accusations that are stated in the extradition request and I do not wish to go to the Netherlands,” adding that “I would like to have children in Serbia and to achieve some more things here.

‘In Dubai for 4 months’

“I stayed in the Netherlands at the time specified in the international arrest warrant. I was there for three months on a tourist trip,” Medjedovic said of whereabouts at the time of the 2023 KyberSwap hack.  

“First I visited Bosnia, then Serbia, then Spain and from Spain I went to the Netherlands,” he said. 

WATCH | Following a trail before Medjedovic’s 2024 arrest:Serbian court documents detail where Andean Medjedovic had been prior to his 2024 arrest.

Dutch authorities note that during his time in the Netherlands, an IP address connected to Medjedovic’s hotel in The Hague was engaged in “suspicious activity” related to the hack. 

They also said Medjedovic identified himself for a flight departing the Netherlands with a Bosnian passport and that three days later, two days before his 21st birthday, he travelled to Sarajevo using a Slovak passport.

Medjedovic told the court he holds a Bosnian passport and does not hold a Canadian one, despite being Canadian.

In response to questions about him, Global Affairs Canada said it “is aware of a Canadian citizen who was detained abroad,” in the summer of 2024 and that “consular officials provided assistance to the individual at the time.”

Following his 2023 travel to Bosnia, the Dutch warrant for his arrest was issued, as was an Interpol Red Notice. His next known whereabouts come nearly half a year later in the United Arab Emirates.

Medjedovic told the Belgrade court he “was in Dubai for four months,” where he went by the name Lorenzo. He also used that name to book an apartment in the Serbian capital, but was arrested when he arrived in the city on Aug. 9, 2024. Interpol Belgrade contacted Dutch authorities that same day.

While he stated that he used fake identification documents, he maintained that he did not use them to travel. “When I stayed in hotels, I used fake names and fake passports. Specifically in the Netherlands, I used a fake Slovak passport, and I did this to keep my privacy because when trading cryptocurrencies, you often become the target of criminals,” he said. 

The Belgrade Higher Court heard from Medjedovic that as of August 2024 he was working as a cryptocurrency freelancer, making about $100,000 US per month. (BIRN)

In its indictment, the U.S. alleges that Medjedovic maintained files in which he wrote “make new bank account under fake ID” and “order documents online (Russian + Brazil + American citizen).”

It also says Medjedovic “documented his plans and methods to launder the criminal proceeds in a file titled: “moneyMovementSystem.” The file contained a step-by-step “operating procedure” for moving cryptocurrency through a mixer. 

Mixers are tools that obfuscate where cryptocurrency is being moved to, and on the other end, where it has come from. 

The “moneyMovementSystem” contained “instructions that would allow co-conspirators to access the stolen funds,” according to the indictment.

A co-conspirator listed in the filings is unnamed, but was “a relative” who “resided in Canada and Cambridge, Mass., among other places.”

Medjedovic was held in the Belgrade District Prison in the fall of 2024. (BIRN)

While Medjedovic was incarcerated in the Belgrade District Prison, more than $6 million US worth of crypto connected to his alleged exploits was moved into a mixer called Tornado Cash. 

According to the U.S. indictment, the co-conspirator was sent $155,000 US via an unnamed cryptocurrency mixer. 

Medjedovic worked with the co-conspirator to “launder the proceeds of the KyberSwap and Indexed Finance exploits,” the indictment said. 

‘Believed to be at large in Bosnia’

After spending 105 days in Serbian custody, Medjedovic was released. 

In its decision denying the Dutch extradition request, the Belgrade Higher Court stated that Dutch prosecutors had not sufficiently proven Medjedovic was the perpetrator of the crimes and that even if he was, those crimes carried too light a sentence domestically to be worthy of extradition.

A previously unreported filing from the U.S. Department of Justice shows it was watching his next moves, and that he may have quickly left Serbia for its neighbour to the west.

“Defendant is believed to be at large in Bosnia,” they wrote on Jan. 17, 2025, two months after his release.

Kyle Armstrong, a former FBI agent who works at blockchain intelligence firm TRM Labs, says, ‘various countries have various rules on extradition, on reciprocity of charges.’ (Jonathan Castell)

Medjedovic said during the Serbian court proceedings that his parents hold Bosnian citizenship, and the fifth estate’s colleagues at the Bosnian Investigative Reporting Network were able to find a number of relatives living in the country.

Emails between the young man and his father appear to show him asking for his parents’ Bosnian identification documents so that he could “get citizenship in another country.” 

The fifth estate and BIRN obtained records showing that a few months after that email chain started, Medjedovic listed an address in Ilidza, a suburb of Bosnia’s capital, Sarajevo, in an application for a passport. 

Those emails surfaced as part of a civil case against him in Ontario. Medjedovic told the Serbian court the lawsuit “was initiated three years ago at the time I was in Brazil, so in the last three years I have not gone to Canada at all.”

‘There are some concerns’

Growing up in Hamilton, west of Toronto, Medjedovic attended a special self-directed high school program at Westmount Secondary School. The Globe and Mail reported in 2016 that the then 13-year-old was in a Grade 12 data management class and had completed Grade 9 and 10 math while in elementary school.

A local television broadcast from 2017 described Medjedovic as the youngest student to ever graduate from high school in the city’s public school district. 

“I don’t really feel any different from the regular high school student,” Medjedovic said at the time. “It’s just that I’ve spent a little less time in high school and I can focus on the stuff I really like in university.”

His father commented in the broadcast on his son’s rush through high school.

“There are some concerns, but we hope for [the] best,” he said. 

Medjedovic’s time at the University of Waterloo in southern Ontario was also relatively short. Within four years, he had obtained his master’s degree.

Unbeknownst to Medjedovic, his online footprint from his time in high school would later be used by Indexed Finance and online sleuths to connect him to the 2021 attack. 

WATCH | Looking for clues in cryptocurrency hack:Indexed Finance and a team of sleuths scoured the internet for hints of who made off with $16 million US in cryptocurrency.

Following a trail of breadcrumbs outlined in a blog post, Indexed found an online user name they say was connected to Medjedovic and the attack.

That username used an email address for the Hamilton-Wentworth District School Board and also was behind an edit on a Wikipedia page for the high school quiz show Reach For The Top. In the Alumni section, just below former Canadian prime minister Stephen Harper, the page had been edited to include “Andean Medjedovic, notable mathematician.”

Medjedovic, fourth from the left in the back row, was cut from a Reach for the Top team just months before his name was added to the high school quiz show’s Wikipedia page. (HWDSB Educational Archives)

“We joked years later whether cutting him from the Reach team was the start of his villain arc,” said Luka Obrovac, who helped coach the team at Westmount Secondary School when Medjedovic was a student in 2016. 

“He wasn’t a team player. He stepped on a lot of toes.” 

‘He needs to be perfect’

In December, in the culmination of a six-month investigation, the fifth estate and BIRN visited the building outside Sarajevo that Medjedovic had listed as his address in 2022.  

When BIRN reporter Nino Bilajac sent Medjedovic’s photo to a building representative, he was surprised by the reply.

Someone had previously come looking for Medjedovic, Bilajac said, translating the text message from Bosnian to English.

“The police were looking for him,” the representative said in a subsequent phone call, and they had been there just a few months prior. 

“They asked the same as you. They brought a picture and asked if I knew this guy by chance, if I had seen him,” he said. “I had not seen him.”  

Bilajac dug deeper and heard from sources that multiple Bosnian police officers had, alongside Dutch prosecutors, attempted to arrest Medjedovic in the country. 

When BIRN put questions to the Bosnian State Investigation and Protection Agency regarding Medjedovic, it said in a statement only that it had acted on an order from the Court of Bosnia and Herzegovina.

WATCH | Looking for Andean Medjedovic in Bosnia:

Looking for Andean Medjedovic outside Sarajevo

BIRN reporter Nino Bilajac contacts a building manager about Canadian crypto fugitive Andean Medjedovic.

Then, days before the new year, millions of dollars in cryptocurrency connected to the Indexed and Kyber schemes, which had been sitting untouched for nearly 440 days, sprang to life. 

The funds had been swapped from a variety of cryptocurrencies and consolidated into one called Ethereum, which signalled that it could be moving to a mixer like Tornado Cash.

However, as of the publishing of this article, the funds have laid dormant. 

“He needs to be perfect,” TRM Labs’ Kyle Armstrong said. “From here until eternity, he needs to be perfect in obfuscating the proceeds of this exploit which are being tracked.”

While the average observer is unable to trace cryptocurrency through a tool like Tornado Cash, those with the right knowledge and software can pierce the veil. 

“You’re not doing yourself any favours with the court, with the prosecutors, running for as long as he’s been running,” said Ari Redbord, global head of policy and government affairs with TRM.

“I think that it’s become harder and harder to hide from the world if you want to exist in the digital space as well,” he said, noting that just using a cellphone can make someone findable. 

“The reality is that at some point you come in and you fall on your sword and potentially do everything you can to ultimately help the government,” Redbord said, noting that could include returning the funds and taking responsibility for the schemes. 

If he doesn’t co-operate, according to Redbord, he could spend 10 or more years in prison.