Crypto Trader Loses 98% in Sandwich Attack on Uniswap

A crypto trader recently fell victim to a sandwich attack while attempting a stablecoin swap, resulting in a significant financial loss. On March 12, the trader initiated a transfer of $220,764 worth of USD Coin (USDC) stablecoin. However, the transaction was intercepted by a Maximum Extractable Value (MEV) bot, which executed a sandwich attack, causing the trader to lose nearly 98% of the value, amounting to approximately $215,500.

The attack occurred on the decentralized exchange Uniswap v3’s USDC-USDT liquidity pool, where $19.8 million worth of value is locked. The MEV bot front-ran the transaction by swapping all the USDC liquidity out of the pool and then putting it back in after the transaction was executed. The attacker tipped Ethereum block builder “bob-the-builder.eth” $200,000 from the $220,764 swap and profited $8,000 themselves.

This incident underscores the risks associated with decentralized finance (DeFi) and the importance of understanding the potential vulnerabilities in blockchain transactions. Sandwich attacks, where an attacker manipulates the order of transactions to profit at the expense of another user, are becoming more prevalent as the DeFi ecosystem grows. Users must take precautions to protect their assets, including using secure wallets, conducting thorough research on DeFi platforms, and being cautious of suspicious activity on the blockchain.

DeFi researcher “DeFiac” speculates that the same trader, using different wallets, has fallen victim to a total of six sandwich attacks. They pointed out that all funds traveled from borrowing and lending protocol Aave before being deposited on Uniswap. Two of the wallets fell victim to an MEV bot sandwich attack on March 12 at around 9:00 am UTC. Ethereum wallet addresses “0xDDe…42a6D” and “0x999…1D215” were sandwich attacked for $138,838 and $128,003 in transactions that occurred three to four minutes earlier. Both transactors made the same swap in the Uniswap v3 liquidity pool as the trader who made the $220,762 transfer.

Others speculate that the trades could be attempts at money laundering. Founder of crypto data dashboard DefiLlama, 0xngmi, suggested that if one has illicit funds, they could construct a very MEV-able transaction, then privately send it to a MEV bot and have them arbitrage it in a bundle. This way, they could wash all the money with close to 0 losses.

While initially criticizing Uniswap, founder of The DeFi Report Michael Nadeau later acknowledged that the transactions didn’t come from Uniswap's front end, which has MEV protection and default slippage settings. Nadeau backtracked on those criticisms after Uniswap CEO Hayden Adams and others clarified the protections Uniswap has in place to fight against sandwich attacks.

This incident serves as a stark reminder of the need for enhanced security measures and user education in the DeFi space. As the technology continues to evolve, it is crucial for users to stay informed about the latest threats and best practices for safeguarding their investments. By taking these steps, users can better protect themselves from falling victim to similar attacks in the future.