Most often, cryptocurrency scammers use straightforward ways to steal digital assets. For example, we are talking about attempts to get to the victim's seed phrase, which allows you to restore access to a specific address in the blockchain and withdraw all coins from it. The signature of malicious transactions is also in demand, which also allows hackers to take all the crypt from the user's wallet.

Today's scheme will be much less obvious, but at the same time quite effective.

How to lose money in cryptocurrencies.

Judging by the data in the blockchain, an anonymous cryptocurrency user exchanged 732,000 USDС stablecoin coins for just 18,000 USDT. This happened during six separate token exchange transactions, and the hackers used the tactics of a so-called sandwich attack.

Sandwich attacks are one of the types of frontrunning and a method of price manipulation in the blockchain, when an attacker inserts his own transactions before and after the victim trader's transaction. This method is often used on decentralized exchanges, where the attacker sees the victim's order, buys, for example, an asset at a low price, and then sells it at a higher price by increasing the value of the asset during the victim's transaction.

As a result, the user receives a coin at a less favorable price, and the attacker gets a profit due to the difference. The name of the attack is due to the fact that the victim appears to be trapped between the hacker's transactions.

The analyst under the pseudonym TheDEFIac commented on the event.:

"An unknown party has become a victim of a sandwich attack in the equivalent of 714 thousand dollars today. During six separate USDC-to-USDT exchange transactions, the user sent 732583.429405 USDC for 18636.232611 USDT."

(One of the victim's transactions, which ended with the exchange of 220 thousand USDС for 5 thousand USDT).

The event attracted attention not only because of the large amount of damage, but also because of the strange location of the attack. Nevertheless, the victim conducted transactions in the USDС-USDT liquidity pool on the Uniswap V3 decentralized exchange, which is considered the most liquid place to exchange these stablecoins. Accordingly, such problems should not have arisen.

The essence of what is happening was explained by DeFi researcher Michael Nadeau. According to him, the MEV bot outstripped the trader's transaction and exchanged all the liquidity, which led to a price mismatch between the two assets, the value of which should remain at $1. However, a major transaction collapsed the token parity at the moment, which is why the decentralized exchange exchanged 732 thousand USDC for 18 thousand USDT.

The bot also paid a large commission of 200 thousand dollars to the creator of the blocks under the pseudonym bob-the-builder.eth. Thus, he provided himself with all the necessary conditions for a successful transaction.

It is worth noting that what is happening is also the victim's fault. A 100 percent slippage was set in his profile settings on the decentralized exchange. We are talking about the maximum possible difference between the amount of the transaction and the coins received.

Traders usually set this indicator at 1-2 percent. A larger indicator like 5 or 10 percent may be needed in trading illiquid meme tokens, which are constantly jumping in price. However, here the slippage rate was unreasonably high.

An anonymous developer of the DeFiLlama platform under the nickname 0xngmi admitted that the victim of the sandwich attack and the attacking party may be connected, and their actions were an attempt to launder money. Here is his comment.

"I think some of these questionable swaps may be money laundering. If you have illegal North Korean funds, you can create a high-yield transaction for MEV, then send it directly to the MEV bot, which will arbitrate it in a bundle — this way you can launder money almost without loss."

Here is another important clarification from the TheDEFIac analyst:

"An interesting point is how exactly the funds were moved before each of these sandwich transactions. All wallets follow the same path, which is quite long and unusual – the funds came from accounts on Binance and Bybit and after 15-20 days were deposited from "clean" addresses via transfers to Aave and Compound in the USDC-USDT pool to other wallets."

"This suggests that either someone is just burning a lot of money, or this is some kind of strange laundering scheme."

Hayden Adams, the developer of the Uniswap decentralized exchange, also commented on the event. However, he has already deleted the original tweet, which remains in the form of a screenshot.

Obviously, Hayden is unhappy with the criticism of the platform because of what happened.

"The slip tolerance has been in place since the launch of v1 in November 2018 and could have prevented this. There are many other mechanisms that help MEV — private mempool, unichain builder architecture, and so on. But it infuriates me when, instead of correcting misinformation, people use it to inflate the value of their assets."

Thus, the developer noted that "reducing slippage would help limit the amount of losses," and this is indeed the case. However, if it really was the activity of scammers, it certainly doesn't make it easier for the victim now.

Here are some tips on how to avoid this situation:

• Reduce transaction slippage.
• Do not use Uniswap. Switch to Sowswap or another aggregator that can provide better execution and prevent MEV.
• Use a custom RPC that does not disclose your transactions publicly.

Recall that the well-known MEV bot on Solana earned about $30 million in the arbitration of user transactions in just two months!

Be careful and please take care of yourself.