Fake passports, $65M US and an Interpol Red Notice: Canadian crypto fugitive vanishes after arrest in Serbia
Court records show Andean Medjedovic has travelled extensively since disappearing from Canada in 2021
Matthew Pierce, Ioanna Roumeliotis, Linda Guerriero · CBC News · Posted: Jan 30, 2026 1:00 AM PST | Last Updated: January 30
Listen to this article
Estimated 14 minutes
After Indexed Finance lost $16.5 million US in cryptocurrency, the firm followed a trail of online breadcrumbs and usernames that it alleges led them to Andean Medjedovic, an 18-year-old Canadian who'd just received a master's degree in pure mathematics. (Tim Kindrachuk)
As his flight departed from Amsterdam's Schiphol airport en route to Kuwait via Istanbul, Canadian crypto fugitive Andean Medjedovic was unaware that his globe-trotting lifestyle would soon be halted.
Just two weeks later, on Dec. 11, 2023, Dutch authorities issued a European arrest warrant for the then 21-year-old, alleging he had pulled off a "sophisticated hack" that netted him $48 million US in cryptocurrency.
The Hamilton native who had graduated from high school at 14 and received a master's degree in pure mathematics at 18 was arrested nine months later in Belgrade, Serbia, where he quickly appeared before a judge.
Documents from extradition proceedings at the Belgrade Higher Court obtained by the fifth estate and the Balkan Investigative Reporting Network (BIRN) provide an extraordinary glimpse into the lifestyle and whereabouts of a young man with an alleged $65 million US in cryptocurrency burning a hole in his pocket and multiple countries seeking his arrest.
For four years, Medjedovic's whereabouts have largely been a mystery to the public. Online speculation had been fuelled by his own statements to journalists, who reported his mentions of South America, unnamed islands and a jail "somewhere in Europe."
Since disappearing in late 2021, according to translated statements made during the Serbian proceedings, he has travelled to Brazil, Dubai, Spain and elsewhere.
"He may be able to live large," said Kyle Armstrong, a former FBI agent who works at blockchain intelligence firm TRM Labs.
"However, to pay your rent, to buy a car, to travel, there's not many places that are willing to accept cryptocurrency," he said. But "there are certain ways that if he has obfuscated his trail thus far, he may have cashed out some of his millions of dollars."
Medjedovic competed in the Ontario High School Chess Championships in 2016 and 2017. (HWDSB Educational Archives)Medjedovic is known in the cryptocurrency space for allegedly using his mathematical and computer programming prowess to drain millions of dollars from two crypto platforms. He gained even more notoriety for subsequently engaging with victims and online observers in ways that buck the trend of accused crypto hackers, who often use the technology's relative anonymity to quietly disappear with their spoils.
Shortly after millions in crypto were extracted from Vietnam-based KyberSwap, a heist attributed to Medjedovic by American and Dutch authorities, the then unidentified attacker sent a publicly visible message to the firm: "Negotiations will start in a few hours when I am fully rested. Thank you."Watch the full documentary, "Canada's Crypto Fugitive," from the fifth estate on YouTube or CBC-TV on Friday at 9 p.m.
KyberSwap offered a 10 per cent bug bounty, a common practice in incidents such as this, where the attack is cynically reframed as a test of the platform's security. The perpetrator is asked to give back some portion of the crypto and in return is able to walk away consequence-free.
"He rejected that out of hand," said TRM's Armstrong.
Instead, the attacker demanded they be given complete control of the Kyber platform and offered to return 50 per cent to investors who had lost funds.
"I know this is probably less than what you wanted. However, it is also more than you deserve," they wrote.
"It was a ransom note," Armstrong said, adding that this was the basis for the extortion charge against Medjedovic levelled by the U.S. Department of Justice in an indictment unsealed in early 2025.
According to the Dutch extradition request, the hack was executed from a hotel in The Hague, which, they say, Medjedovic checked into using a fake Slovak passport.
These grainy images were included in a European arrest warrant for Medjedovic and show a passport in the name of Luka Krajovic he allegedly used and security camera footage of him at a hotel. (District Public Prosecutor’s Office, The Hague)Medjedovic "suddenly" departed the hotel the morning after the hack took place, they said, despite the fact that he had paid for the following month's accommodation.
By that point, he had already been on the run for two years. In late 2021, an Ontario Superior Court judge issued a bench warrant for his arrest after he failed to appear in a civil case launched against him by an investor in a crypto firm called Indexed Finance.
Medjedovic allegedly, at age 18, exploited vulnerabilities in Indexed's programming and made off with $16.5 million U.S.
U.S. authorities said Medjedovic "used similar means" to exploit Kyber and Indexed. Both schemes relied on hundreds of millions of dollars in borrowed funds that were used to execute trades and misrepresent the supply and demand of certain cryptocurrencies. Confused by the flurry of trading activity, the platforms allowed millions of dollars in assets to be purchased for next to nothing.
"So instead of his dollar-for-dollar exchange, he exchanges one dollar for many dollars worth of assets," Armstrong said.
The Globe and Mail reported in 2016 that Medjedovic, shown here in a school yearbook, completed Grade 9 and 10 math while still in elementary school. (HWDSB Educational Archives)The fifth estate emailed Medjedovic to request a comment on the allegations against him.
He replied: "I have only one defence to the allegations: 'I'm a racist.' Please include that, that's all, thanks."
Buried in the computer code used to pull off the Indexed attack is a racist slur for Black people, and in Kyber's a comparison of the theft to sexual assault. A cryptocurrency address connected to Medjedovic also contains a well known neo-Nazi symbol.
Regarding his arrest in Serbia and the Dutch extradition request, Medjedovic told the Belgrade Higher Court: "I deny all the accusations that are stated in the extradition request and I do not wish to go to the Netherlands," adding that "I would like to have children in Serbia and to achieve some more things here.
'In Dubai for 4 months'
"I stayed in the Netherlands at the time specified in the international arrest warrant. I was there for three months on a tourist trip," Medjedovic said of whereabouts at the time of the 2023 KyberSwap hack.
"First I visited Bosnia, then Serbia, then Spain and from Spain I went to the Netherlands," he said.
WATCH | Following a trail before Medjedovic's 2024 arrest:
Travels since 2021
January 30|
Duration1:03Serbian court documents detail where Andean Medjedovic had been prior to his 2024 arrest.
Dutch authorities note that during his time in the Netherlands, an IP address connected to Medjedovic's hotel in The Hague was engaged in "suspicious activity" related to the hack.
They also said Medjedovic identified himself for a flight departing the Netherlands with a Bosnian passport and that three days later, two days before his 21st birthday, he travelled to Sarajevo using a Slovak passport.
Medjedovic told the court he holds a Bosnian passport and does not hold a Canadian one, despite being Canadian.
In response to questions about him, Global Affairs Canada said it "is aware of a Canadian citizen who was detained abroad," in the summer of 2024 and that "consular officials provided assistance to the individual at the time."
Following his 2023 travel to Bosnia, the Dutch warrant for his arrest was issued, as was an Interpol Red Notice. His next known whereabouts come nearly half a year later in the United Arab Emirates.
Medjedovic told the Belgrade court he "was in Dubai for four months," where he went by the name Lorenzo. He also used that name to book an apartment in the Serbian capital, but was arrested when he arrived in the city on Aug. 9, 2024. Interpol Belgrade contacted Dutch authorities that same day.
French President Emmanuel Macron awaits Indonesian President Prabowo Subianto (not seen) at the Elysee Presidential Palace in Paris, France on January 23, 2026. © Photo by Mustafa Yalcin/Anadolu via Getty Images
