Fake passports, $65M US and an Interpol Red Notice: Canadian crypto fugitive vanishes after arrest in Serbia

As his flight departed from Amsterdam's Schiphol airport en route to Kuwait via Istanbul, Canadian crypto fugitive Andean Medjedovic was unaware that his globe-trotting lifestyle would soon be halted.

Just two weeks later, on Dec. 11, 2023, Dutch authorities issued a European arrest warrant for the then 21-year-old, alleging he had pulled off a "sophisticated hack" that netted him $48 million US in cryptocurrency. 

The Hamilton native who had graduated from high school at 14 and received a master's degree in pure mathematics at 18 was arrested nine months later in Belgrade, Serbia, where he quickly appeared before a judge.

Documents from extradition proceedings at the Belgrade Higher Court obtained by the fifth estate and the Balkan Investigative Reporting Network (BIRN) provide an extraordinary glimpse into the lifestyle and whereabouts of a young man with an alleged $65 million US in cryptocurrency burning a hole in his pocket and multiple countries seeking his arrest.

For four years, Medjedovic's whereabouts have largely been a mystery to the public. Online speculation had been fuelled by his own statements to journalists, who reported his mentions of South America, unnamed islands and a jail "somewhere in Europe."

Since disappearing in late 2021, according to translated statements made during the Serbian proceedings, he has travelled to Brazil, Dubai, Spain and elsewhere. 

"He may be able to live large," said Kyle Armstrong, a former FBI agent who works at blockchain intelligence firm TRM Labs. 

"However, to pay your rent, to buy a car, to travel, there's not many places that are willing to accept cryptocurrency," he said. But "there are certain ways that if he has obfuscated his trail thus far, he may have cashed out some of his millions of dollars." 

Medjedovic is known in the cryptocurrency space for allegedly using his mathematical and computer programming prowess to drain millions of dollars from two crypto platforms. He gained even more notoriety for subsequently engaging with victims and online observers in ways that buck the trend of accused crypto hackers, who often use the technology's relative anonymity to quietly disappear with their spoils. 

Shortly after millions in crypto were extracted from Vietnam-based KyberSwap, a heist attributed to Medjedovic by American and Dutch authorities, the then unidentified attacker sent a publicly visible message to the firm: "Negotiations will start in a few hours when I am fully rested. Thank you."

KyberSwap offered a 10 per cent bug bounty, a common practice in incidents such as this, where the attack is cynically reframed as a test of the platform's security. The perpetrator is asked to give back some portion of the crypto and in return is able to walk away consequence-free.

"He rejected that out of hand," said TRM's Armstrong. 

Instead, the attacker demanded they be given complete control of the Kyber platform and offered to return 50 per cent to investors who had lost funds. 

"I know this is probably less than what you wanted. However, it is also more than you deserve," they wrote.