Andean Medjedovic was 18 years old when he made a decision that would irrevocably alter the course of his life.

In the fall of 2021, shortly after completing a master’s degree at the University of Waterloo, the math prodigy and cryptocurrency trader from Hamilton had conducted a complex series of transactions designed to exploit a vulnerability in the code of a decentralized finance platform. The manoeuvre had allegedly allowed him to siphon approximately US$16.5-million in digital tokens out of two liquidity pools operated by the platform, Indexed Finance, according to a U.S. court document.

Indexed Finance’s leaders traced the attack back to Mr. Medjedovic, and made him an offer: Return 90 per cent of the funds, keep the rest as a so-called “bug bounty” – a reward for having identified an error in the code – and all would be forgiven. Mr. Medjedovic would then be free to launch his career as a white hat, or ethical, hacker.

Mr. Medjedovic didn’t take the deal. His social media posts hinted, without overtly stating, that he believed that because he had operated within the confines of the code, he was entitled to the funds – a controversial philosophy in the world of decentralized finance known as “Code is Law.” But instead of testing that argument in court, Mr. Medjedovic went into hiding. By the time authorities arrived on a quiet residential street in Hamilton to search his parents’ townhouse less than two months later, Mr. Medjedovic had moved out, taking his electronic devices with him.

Then, roughly two years later, he struck again, netting an even larger sum – approximately US$48.4-million – by conducting a similar exploit on another decentralized finance platform, U.S. authorities allege.

Mr. Medjedovic, now 22, faces five criminal charges – including wire fraud, attempted extortion and money laundering – according to a U.S. federal court document that was unsealed earlier this year. If convicted, he could be facing decades in prison.

First, authorities will have to find him.

The leaders of Indexed Finance didn’t know Mr. Medjedovic’s age when they publicly accused the teen of exploiting their platform.

“Because we knew he was a master’s student, we believed that he was older,” Laurence Day, a resident of Leeds, in Britain, later stated in an affidavit.

Master’s students are typically in their 20s. But Mr. Medjedovic, who goes by Andy, was not a typical student.

A slight kid with dirty blond hair, blue eyes and mischievously arched brows, Mr. Medjedovic grew up in Hamilton with his parents and his younger brother, Denean, and attended Westmount Secondary School, a highly-rated institution known for its unconventional self-directed approach to learning. In 2017, he was part of a four-student Westmount team that took the top spot in a regional coding contest.

The teen math prodigy wasn’t the only member of his family who was comfortable with technology; his parents, Ediz and Sanja Medjedovic, repaired computers for their neighbours, according to an Ontario court document.

Having completed high school at an accelerated pace, Mr. Medjedovic was just shy of his 15th birthday when he started his undergraduate studies in pure mathematics at the University of Waterloo. He finished what is typically a four-year bachelor’s program in a brisk three years, then breezed through a master’s degree in a single year.

On his CV, later filed in Ontario Superior Court, he listed his Putnam Competition score as 39 – a result in an annual North American undergraduate math contest that, if accurate, would render him a “math genius,” according to Indexed Finance’s U.S. lawyer, Jason Gottlieb. (The competition is known for its difficulty; while the maximum score is 120, the median score is often in the low single digits.) Mr. Medjedovic received scholarships and came close to winning a cash prize in a university math contest called the Bernoulli Trials. He also listed several rather exalted hobbies on his CV: meditation, playing blindfolded chess and crypto trading.

In the summer of 2021, as he was wrapping up his studies, Mr. Medjedovic successfully competed in two hacking contests run by an organization called Code Arena, according to court documents. During the competitions, participants hunt for weaknesses in the code governing decentralized autonomous organizations, or DAOs, which are structures deliberately designed without a central authority that utilize a digital ledger known as a blockchain.

Then, on Oct. 14, Mr. Medjedovic allegedly unleashed his skills on Indexed Finance, a platform that allows users to trade multiple virtual currencies through a single token, similar to a mutual fund with many stocks in it.

Mr. Medjedovic took out what’s known in decentralized finance as a flash loan – an uncollateralized loan in which assets are borrowed and repaid within the same series of transactions. Then, using approximately US$157-million in borrowed assets, he allegedly executed a complex sequence of trades that manipulated token prices in two of Indexed Finance’s liquidity pools, allowing him to transfer US$16.5-million of digital tokens to his own wallet, according to a U.S. court filing.

None of the allegations have been proven in court. Mr. Medjedovic did not provide a response to the allegations against him when reached online by The Globe and Mail.

In the days following the attack, Indexed Finance, its lawyer and even one of the founders of the hacking contest implored Mr. Medjedovic to return the tokens.

Mr. Gottlieb praised Mr. Medjedovic on social media as a “young, bright guy” with a “bright future.” But just because he was good at math didn’t mean that he understood the law, Mr. Gottlieb said. In an e-mail sent to Mr. Medjedovic’s personal address, he cautioned the teen that the stolen tokens were easy to trace and would be difficult to access. “Don’t screw up your whole future over money you can’t ever touch anyway,” Mr. Gottlieb wrote.

But Mr. Medjedovic wouldn’t budge. He didn’t deny that he was behind the exploit – in fact, he took credit for it on the social media platform X – but he implied that his actions were lawful.

“If Indexed wants to insinuate that I did something wrong and resort to name-calling, LOL,” he wrote, later adding: “You were out-traded. There is nothing you can do about that.”

The Code is Law philosophy is based on the straightforward premise that if the code governing a platform permits a user to do something, then the action is legal. The analogy that is often used is that of algorithmic high-frequency trading. If one Wall Street hedge fund is able to profit by exploiting a pattern in another firm’s trades, the loser doesn’t have any legal recourse; that’s simply the risk that comes with playing the game.

Similarly, proponents of Code is Law argue that because the code governing decentralized finance platforms is open source, and because users choose to use the platform, those users are voluntarily taking on the risk that someone may exploit whatever flaws or loopholes exist within the code.

Not everyone agrees. “Code is not law. Law is law,” Mr. Gottlieb wrote in a lengthy thread to Mr. Medjedovic on X in late October, 2021. “And what you did was not a ‘clever trade.’ It was market manipulation. It’s illegal. And people go to prison for it.”

The Code-is-Law argument has never been tested in a Canadian court. But south of the border, where Mr. Medjedovic has been criminally charged, it hasn’t held up under scrutiny. In April, 2024, a New York jury criminally convicted trader Avraham Eisenberg of fraud and commodities manipulation for exploiting a decentralized cryptocurrency exchange called Mango Markets for US$110-million. Part of Mr. Eisenberg’s defence was that what he hadn’t “hacked” the platform; he’d simply taken advantage of its weaknesses.

Less than a month after the Indexed Finance attack, a U.S. company named Cicada 137 LLC sued Mr. Medjedovic in Ontario. The identity of the person or people behind the company is unknown, but Cicada said it lost US$9.69-million worth of digital tokens to the exploit. (It’s common for significant investors in cryptocurrency to shield their identities.)

The judge granted Cicada a civil search warrant, and over the course of more than seven hours, lawyers turned the Medjedovic family home inside out. But the evidence they found likely was limited; Mr. Medjedovic left home after receiving death threats, and had taken his phone and computer with him, according to court documents.

In mid-December that year, Mr. Medjedovic transferred several million dollars’ worth of tokens out of a digital wallet associated with the attack, stopping after he’d been served with a court order via e-mail. He attended an urgent court hearing that day via Zoom, but he kept his camera off, leaving his whereabouts unknown.

Justice Fred Myers, the Ontario judge overseeing the case, urged Mr. Medjedovic to deposit the disputed tokens with a custodian and participate in the legal process.

“Continuing to remain in hiding is no way to start one’s adult life,” the judge wrote. “Moreover, the civil process in Ontario is very fair and balanced. Mr. Medjedovic will be heard if he participates.”

At least initially, Mr. Medjedovic seemed to be considering mounting a legal defence. “I am looking for the most elite crypto lawyers,” he tweeted. “I will need an entire team.”

But he failed to show up at the Toronto courthouse at 361 University Ave. on Dec. 21, as ordered by the judge, or to put the disputed tokens into custody. Justice Myers issued a warrant for Mr. Medjedovic’s arrest, imploring the teen to turn himself. “I can assure Andean Medjedovic that litigation is not like a fine wine that improves with age,” he wrote.

Mr. Medjedovic’s parents told authorities that they didn’t know their son’s whereabouts. They declined to comment for this story, according to Duncan Boswell, their lawyer at Gowling WLG. But Justice Myers was skeptical of their assertions of ignorance. “It seems quite unlikely that the parents are not in touch with him and do not know where he is,” he wrote.

In fact, in one of two voicemails that Mr. Medjedovic’s father left for Mr. Gottlieb on Oct. 21, 2021, he said he’d recently been in contact with his son. In the second, he hinted that the teen was unstable.

“I’m just telling you now as a parent, if this child – and he did before – loses his nerve, he may commit something that you’re all gonna regret. The money’s gonna be gone, because he’s the only one who knows how to get it and you will not get anything, and I will not have my child,” Ediz Medjedovic said, according to court documents.

In November, 2023, two years after the Indexed Finance exploit, Mr. Medjedovic allegedly perpetrated a very similar scheme, targeting a decentralized finance platform called KyberSwap. This time he worked with an unnamed co-conspirator – a relative who had lived in Canada and Cambridge, Mass., as well as other places, according to the U.S. indictment.

Benjamin Bathgate, one of the lawyers representing Cicada, said it’s not unusual for someone who has successfully exploited a decentralized finance platform to replicate the attack.

“A bad actor not brought to justice and held to account for one act of fraud will surely commit another,” Mr. Bathgate, a partner at WeirFoulds LLP, said in an e-mail.

“Underground blockchain geniuses from Canada, the U.S. or otherwise are exploiting digital contracts, stealing user investments, and lowering the reliability and potentially the future viability of the US$20-billion decentralized marketplace. The question becomes with what vigour our criminal justice systems will pursue them when they go offline and come up for air,” he added.

Mr. Medjedovic struggled to access some of the US$48.4-million in digital tokens he obtained from KyberSwap, according to a U.S. court document. Because the funds can be traced to the attack, some of the service providers he attempted to use to transfer the tokens blocked his transactions.

By early 2024, U.S. law enforcement was watching Mr. Medjedovic. While looking for ways to transfer the tokens, he had unwittingly enlisted the help of an undercover law-enforcement official in Brooklyn, N.Y.

The Globe contacted Mr. Medjedovic through several e-mail addresses used by the Ontario court to serve him with legal documents, and eventually received a reply from one of those addresses. The person responding, who identified himself as Andy, offered to answer some questions through the encrypted chat app, Signal.

It’s not the first time that Mr. Medjedovic has corresponded with a reporter. In March, 2023, he told crypto news site DL News that he’d travelled through Europe and South America and was on an island he declined to name, working as a white hat hacker.

Earlier, he’d told Bloomberg Businessweek that he was “not concerned about ‘getting a job.‘”

“Waging in the cage is not my idea of a good life,” Mr. Medjedovic had said, likely referring to an internet meme called the “wage cage,” which likens office cubicles to cages.

But the cage he’d eventually find himself in wasn’t a metaphorical one.

Last summer, Mr. Medjedovic was arrested in a European country he declined to name and spent “hundreds of days locked in a cage,” he told The Globe via Signal, using racist slurs to describe his fellow inmates. He’d recently gotten out after the country that had held him decided, after some deliberation, not to extradite him, he said.

“By far the worst bit is they took literally all of my property, computers and everything and sent it to the liberals,” he wrote, referring to the administration of then U.S. president Joe Biden. Mr. Medjedovic said he hopes to recover his possessions but anticipates an “uphill battle.”

“My life is mostly fine, but a lot of stuff with being sued/hunted is terrible, a lot of stuff did not go the way I planned,” Mr. Medjedovic wrote. He did not elaborate when asked what his plan had been, other than to say that being arrested “wasn’t the worst possible outcome, but still pretty bad.”

Asked about Mr. Medjedovic’s arrest, a spokesperson for Global Affairs Canada said the department “is aware of a Canadian citizen who was detained abroad last summer.”

“Consular officials provided assistance to the individual at the time. Due to the provisions of the Privacy Act, no information can be disclosed,” Charlotte MacLeod said in an e-mail.

John Marzulli, a spokesperson for the U.S. Attorney’s Office for the Eastern District of New York, declined to comment on the arrest, saying only that Mr. Medjedovic “remains a fugitive.”

The case against Mr. Medjedovic can’t proceed until he’s been extradited to the United States. Rachel Maimin, a partner in the white-collar defence group at New Jersey-based Lowenstein Sandler LLP, said the indictment is likely to restrict his movement. “If a country has a very broad extradition treaty with the United States, you might not want to go there,” she explained.

Cicada is “somewhat reassured” by the U.S. criminal charges, but disappointed by the lack of progress in Canada said Jessica Stansfield, a partner at WeirFoulds who works with Mr. Bathgate.

“Why is a Canadian teen, prolific at exploiting decentralized markets and causing harm to Canadians and investors around the world, being held to account in the courts of New York?” said Ms. Stansfield.

She and Mr. Bathgate said their client “will continue its dogged pursuit of him until justice is served and the cryptocurrency tokens returned.”

Mr. Medjedovic, meanwhile, seems hopeful that his case will be dropped. Since U.S. President Donald Trump’s inauguration, regulators have pulled back on cryptocurrency-related investigations and lawsuits.

“The silver lining to all of this is that Trump promised to stop the persecution of crypto people,” Mr. Medjedovic wrote on Signal. “Like, half of the people involved in this resigned/stepped down recently.”