User Swaps 442,000 USDC on UniSwap and Received Just 11,000 USDT: Here’s What Happened

A user lost $431,000 in three transactions as he intended to swap his 442,000 USDC on the decentralized exchange Uniswap for Tether’s stablecoin.

Swapping tokens on decentralized exchanges (DEX) can be tricky, primarily due to issues like slippage, low liquidity, and MEV bot attacks. Yesterday, a user lost $431,000 over three different transactions while simply trying to swap between two prominent stablecoins, USDC and USDT.

Blockchain securities firm Peck Shield alerted users to this error on Wednesday, which looks similar to a sandwich attack. Notably, such exploits have frequently occurred on the Ethereum network due to its complex smart contract usage and open mempool.

Here’s What Happened

Three addresses, “0x5D14,” “0x999b,” and “0x5A89,” placed an order to swap 91,000 USDC, 131,000 USDC, and 220,800 USDC on DEX UniSwap V3. Notably, data from Etherscan indicates that these transactions had just four minutes between them.

However, the wallet addresses received a combined 11,000 USDT from the transaction, which was supposed to be a 1:1 swap. This represented a loss of $431,000 for the wallet owners.

While the transaction came from three different addresses, data shows they might be from the same owner. A look at the transaction history shows they have one thing in common: the stablecoins came from Aave’s $1.2 billion USDC pool a few hours before the transaction.

Possible MEV Attack

Meanwhile, all pointers show that the wallets may have been sandwiched by a maximum extractable volume (MEV) bot. As typical of such attacks, these bots front-run the targeted transaction, manipulating the prices of assets in the liquidity pool.

The higher rates then affect the victims’ swap rates, which the bots benefit from by back-running the transaction. In this case, data shows that the MEV bot front-ran the transaction by swapping 18 million USDC, driving the rates for USDC to USDC in the liquidity pool by a factor of 44.

As the user’s swap order processed at that factor, the MEV bot back-ran the transaction, claiming over $200,000 in profits. Meanwhile, further analysis shows that the amountOutMinimum, a setting on UniSwap V3 that prevents such attacks, was set at zero, allowing the bot to pull the pool manipulation successfully.

The Crypto Basic earlier reported that the Ethereum Foundation once fell victim to this MEV bot manipulation. The non-profit organization lost $9,000 from its 1,700 ETH sell-off in 2023.