KyberSwap, Indexed Finance hacker dumps $2M in crypto

An Ethereum wallet linked to the Indexed Finance and KyberSwap exploits resurfaced after a year of silence, selling more than $2 million in tokens.

An Ethereum address tied to past decentralized finance exploits moved more than $2 million worth of tokens after staying inactive for about a year.

According to an on-chain update shared by Lookonchain on X on Dec. 30, the wallet, identified as 0x3EBF, sold large amounts of UNI, LINK, CRV, and YFI in a single burst of activity.

Dormant hacker-linked wallet comes back to life

Blockchain data shows the address sold roughly 226,961 UNI worth about $1.36 million, alongside 33,215 LINK valued near $410,000, 845,806 CRV worth around $328,000, and just over 5 YFI valued at roughly $17,500. Smaller token balances were also reduced.

The wallet has been linked to funds stolen during the Indexed Finance exploit in 2021 and the KyberSwap attack in 2023. Indexed Finance lost around $16.5 million after its index pools were manipulated using flash loans and pricing distortions. At the time, the attacker argued the trades were valid under smart contract rules.

KyberSwap was later hit in November 2023, when its Elastic liquidity pools were drained for nearly $49 million across several chains. The attacker exploited a flaw in how liquidity positions were calculated, allowing repeated extraction of funds. After the incident, the attacker attempted to extort the protocol by demanding control in exchange for returning part of the stolen assets.

U.S. authorities unsealed an indictment in February 2025 accusing 22-year-old Canadian Andean Medjedovic of carrying out both attacks. Prosecutors allege he laundered funds through mixers and cross-chain bridges and tried to pressure KyberSwap’s team following the exploit. Medjedovic remains at large.

Wallet activity highlights ongoing theft risks

2025 has been a record year for crypto-related thefts. Industry estimates show total losses in 2025 ranged between $2.7 billion and $3.4 billion, based on full-year figures from Chainalysis.

The majority of losses this year were linked to centralized platforms, in contrast to previous cycles where DeFi exploits dominated. Over $2 billion in thefts, or about 60% of the total, were attributed to organizations with ties to North Korea.

The largest single incident was the $1.5 billion Bybit hack in February, followed by major breaches at Cetus DEX ($223 million) and Balancer ($128 million). While individual wallet compromises increased sharply to 158,000 incidents, the average loss per victim declined.