DeFi trader hit by MEV attack swapped 440K USDC for just 10K USDT

While the three affected transactions all come from distinct addresses, a brief look at their transaction histories indicates they are likely to be from the same individual.

In all three cases, the tokens used in the swaps were withdrawn from the DeFi lending platform Aave’s $1.2 billion USDC pool around seven hours previously. USDT was also withdrawn but not swapped.

MEV bots ready to pounce

MEV bots scan Ethereum’s mempool, the list of pending transactions, looking for opportunities to profit from the actions of other users.

Typically, this involves sending a transaction before the victim’s in order to manipulate the price of assets in the liquidity pool via which assets are swapped on a decentralized exchange such as Uniswap.

In this case, the bot’s front-run transaction swapped 18 million USDC, increasing the price of USDT within the pool by a factor of 44. The victim’s original transaction then goes through, and finally, the bot back-runs the victim, clearing approximately $200,000 profit.

Trades are usually protected via “slippage” settings, which define a minimum amount of tokens to be received or the transaction reverts. However, for these swaps, the amountOutMinimum parameter was set to zero.