$50.4M aEthUSDT
Swap Incident

Executive Summary

A user executed an Aave collateral rotation (aEthUSDT → aEthAAVE) through CoW Protocol's flashloan adapter. The signed order specified a minimum buy of only 324.95 aEthAAVE — the catastrophic outcome was baked into the quote before execution. The route terminated in a SushiSwap V2 pool holding only 331.63 AAVE and 17.65 WETH, pushing 1,017x the pool's WETH reserve into it.

A backrunner at tx index 2 immediately arbitraged the wrecked pool, extracting 17,929.77 WETH and paying 13,087.73 ETH (~$27.1M) to the Titan block builder. The builder paid only 568.43 ETH (~$1.18M) to the Lido proposer, retaining an estimated ~$25.9M in builder profit from this single block.

Play-by-Play

The incident unfolded in four phases over approximately three hours.

Swap Routing

The settlement routed through only two pools, each far too shallow to absorb a $50M market order.

Financial Breakdown

Where the $50.4M in slippage losses went.

MEV & Block Builder

The swap sat at tx index 1. The backrunner at tx index 2 extracted 17,929.77 WETH from the wrecked Sushi pool, paying 73% to the builder as a bribe. The builder retained ~$25.9M and forwarded only ~$1.18M to the Lido proposer. A follow-up arb at tx index 3 continued pool normalization.

Wallet Network

The entity behind this incident controls $414M+ in USDT across 7+ EOA wallets, all feeding into a single accumulator that has zero outgoing transactions.

Address Poisoning Detected

Wallet 0x651b...415b is being actively targeted by address poisoning attacks. Multiple attacker-controlled addresses send zero-value or dust USDT transfers designed to mimic the legitimate accumulator.

Full Transaction Timeline

Key Findings

• 1
  Route was born bad
  The signed order specified a minimum buy of only 324.95 aEthAAVE for 50.4M aEthUSDT. The catastrophic outcome was computed into the quote before the user signed it. CoW's "smart slippage" of 121 bps was applied to an already-insane quote.
• 2
  Catastrophic slippage
  99.93% of value lost. The route pushed 17,957 WETH into a SushiSwap V2 pool holding only 331 AAVE and 17.65 WETH — 1,017x the pool's WETH reserve.
• 3
  Poor routing
  Only 2 pools used (Uniswap V3 + SushiSwap V2). No order splitting, TWAP execution, or OTC desk usage.
• 4
  ~$37M MEV extraction
  Backrunner at tx index 2 extracted 17,929.77 WETH from the wrecked pool. Titan Builder kept ~$25.9M, backrunner kept ~$9.99M, Lido proposer received ~$1.18M. Builder retained 96% of the backrun bribe.
• 5
  Active address poisoning
  The user's wallets are targeted by address poisoning attacks with spoofed addresses sharing prefix 0x2e4 and suffix acbf.
• 6
  Large, coordinated entity
  The wallet network controls $414M+ in USDT across 7+ wallets, all feeding into a single accumulator with zero outgoing transactions.
• 7
  CoW fees minimal
  CoW Protocol collected only $447 (4.06 AAVE). CoW's batch auction prevented direct sandwich attacks but could not protect against the fundamental routing failure.
• 8
  Aave's response
  Aave will return $600K in fees collected from the transaction. The team is investigating improved guardrails for large orders.