**The "Code is Law" Defense Falls Short: How a 22-Year-Old Exploited DeFi Protocols for $65 Million**

The U.S. Department of Justice has formally prosecuted Andean Medjedovic, a 22-year-old Canadian, on five felony counts including telecommunications fraud, computer system intrusion, extortion, and money laundering. The case reveals a troubling trend in DeFi security breaches.

Between 2021 and 2023, Medjedovic systematically compromised two major decentralized finance platforms—Indexed Finance and KyberSwap—by identifying and exploiting vulnerabilities in their smart contracts. Through carefully crafted contract manipulation, he unlawfully transferred approximately $65 million in digital assets.

What makes this case particularly significant is Medjedovic's legal argument: he contended that exploiting smart contract bugs fell within the bounds of "code is law"—a foundational principle in crypto culture suggesting that code execution is the ultimate source of truth. U.S. prosecutors rejected this interpretation outright, establishing a critical legal precedent.

The judiciary's position signals that code execution alone does not shield hackers from criminal liability. Regardless of blockchain philosophy, unauthorized access and theft remain prosecutable offenses. If convicted on all counts, Medjedovic faces up to 20 years in federal prison.

This prosecution underscores a growing reality: DeFi platforms operate within both code and law. While blockchain technology emphasizes decentralization and immutability, the legal framework continues to hold individuals accountable for malicious actions, even when technically feasible within smart contract systems. The case raises critical questions about security audits, vulnerability disclosure, and the responsibilities of protocol developers to protect user funds.