Crypto Trader Swaps Out Over $700K for $19K in Sandwich Exploit

A cryptocurrency trader recently exchanged $732,000 for just $19,000, potentially falling victim to a large-scale sandwich attack, according to on-chain data.

The incident, which unfolded on Wednesday, has sparked considerable discussion on X (formerly known as Twitter), primarily due to the significant loss involved and the unusual nature of the transaction.

The trade occurred within the USDC-USDT liquidity pool on Uniswap V3, one of the most liquid pools for stablecoins.

DeFi researcher Michael Nadeau revealed that an MEV bot front-ran the trader’s transaction by draining all available liquidity, creating a price disparity between two coins that should have been pegged to $1.

The bot also enlisted a block builder named bobTheBuilder to prioritise its transaction.

Pseudonymous DeFiLlama developer 0xngmi speculated that the mishandled swaps could be part of a deliberate money laundering effort.

MEV bots, which function as blockchain-based high-frequency traders, exploit blockchain mechanics to seize arbitrage opportunities at high speeds.

What’s a Sandwich Attack?

A sandwich attack is a type of front-running exploit where an attacker places two transactions around a victim’s transaction to manipulate the price and profit from the difference.

To break it down, it is a type of manipulation where a bad actor takes advantage of a trader's transaction by "sandwiching" it between two other transactions.

Here's how it works:

1) The victim places a trade, say buying or selling a cryptocurrency.

2) The attacker notices the trade and quickly places two transactions—one just before the victim’s transaction and one just after it.

3) The attacker uses this to manipulate the price of the cryptocurrency by buying it at a lower price before the victim's trade and then selling it at a higher price right after.

As a result, the victim gets stuck with a worse price, and the attacker profits from this price manipulation.

It is called a "sandwich" because the victim's trade is in the middle, like the filling in a sandwich.

Potential Bad Swaps to Launder Funds a Possibility

Self-declared Etherscan enthusiast, TheDEFIac, posted a thread suggesting that the "bad swaps" could be part of a money laundering scheme.

One particularly suspicious transaction involved the exchange of $220,806 in USDC for just over $5,000 in USDT.

TheDEFIac posted:

"The interesting part here is how did the funds travel before each of the sandwiched [transactions]. All wallets follow the same path, which is rather long and quite unsual."

Security experts often highlight that cybercriminals attempting to conceal illicit funds typically route money through multiple inefficient hops and unnecessary protocols to obscure its origin.

Tracking the transaction flow, TheDEFIac noted that the funds originated from Binance and Bybit exchange wallets before being deposited into the USDC-USDT liquidity pool.

He concluded that the unusual movement of funds could either signal a significant financial loss or an attempt at laundering money.