A crypto user lost millions during a large token swap on the decentralized finance protocol Aave, while a Maximal Extractable Value (MEV) bot exploited the transaction and earned nearly $10 million.
A newly funded wallet from Binance holding $50.4 million in Tether attempted to swap the entire amount for Aave tokens. The trade was executed through the decentralized exchange aggregator CoW Protocol and the SushiSwap DEX.
However, the transaction produced a disastrous result. According to Etherscan, the wallet received only 327 AAVE tokens, worth roughly $36,000.
This meant the user effectively paid about $154,000 per AAVE, far above the market price of roughly $114, resulting in an almost complete loss of the funds involved in the swap.
The situation worsened when an MEV bot carried out a sandwich attack. These bots monitor pending blockchain transactions and attempt to profit by manipulating prices before and after large trades.
In this case, the bot front-ran the swap by flash-borrowing $29 million in Ether (wrapped ETH) from Morpho. It used the funds to buy AAVE on Bancor, artificially pushing the token’s price higher before the victim’s transaction executed.
After the user’s swap went through at the inflated price, the bot immediately sold the tokens on SushiSwap, walking away with an estimated $9.9 million profit.
User ignored slippage warnings, says Aave
Automated market makers such as SushiSwap rely on algorithmic pricing formulas that adjust slippage — the difference between the expected price of a trade and the final execution price — based on the liquidity in the trading pool and the size of incoming orders.
Stani Kulechov, the founder of Aave, said in a post on X that the platform’s interface warned the user about “extraordinary slippage” caused by the unusually large size of the single transaction.
According to Kulechov, the user acknowledged the warning on their mobile device and continued with the swap regardless.
“The user confirmed the warning and proceeded with the swap, accepting the high slippage, which ultimately resulted in receiving only 324 AAVE tokens in return,” he said.
Meanwhile, the team behind CoW DAO also addressed the incident on X. The organization stated that the user had been clearly informed that the trade could result in losing nearly the entire value of the transaction.
Despite those warnings — and having to explicitly approve the trade after seeing them — the user still chose to proceed with the swap.
“No DEX, DEX aggregator, public liquidity pool, or private liquidity pool (or combination thereof) would have been able to fill this trade at anywhere near a reasonable price.”
CoW DAO said the incident highlights that DeFi user experience still needs improvement to better protect users. The organization added that it plans to refund any protocol fees linked to the transaction.
Meanwhile, Stani Kulechov stated that Aave sympathizes with the affected user and will attempt to reach out to them to return roughly $600,000 in fees collected from the swap.
“The key takeaway is that while DeFi should remain open and permissionless, allowing users to perform transactions freely, there are additional guardrails the industry can build to better protect users.”
