A $50M DEX Swap With a $36K Outcome

Coin Metrics State of the Network is an unbiased, weekly view of the crypto market informed by our own network (on-chain) and market data.

Key Takeaways

• A $50M USDT swap via Aave’s interface ended with only ~$36K of AAVE after routing across multiple DeFi venues in a single block.
• The trade was ultimately routed into a SushiSwap WETH/AAVE pool with only ~$75K in liquidity, causing extreme price impact and leaving millions to surrounding MEV.
• The incident shows how large orders, shallow onchain liquidity, and routing failures can lead to poor execution, highlighting the need for stronger guardrails and smarter routing in permissionless markets.

The Swap that Lost $50M

One of the defining features of blockchains and decentralized finance (DeFi) is its open and permissionless nature. While these properties have unlocked new efficiencies and forms of market access, they have also occasionally resulted in episodes like protocol exploits, oracle mispricings, or operational errors.

On March 12th, a user executed a swap worth $50M that resulted in a loss of 99.9% of its initial value. The wallet converted $50.4M in USDT through the Aave interface on Ethereum mainnet, only to receive $36K worth of AAVE in return. This makes the incident one of the most dramatic examples of execution risk onchain, as a large trade met shallow liquidity in a permissionless system.

In this issue of State of the Network, we unpack the mechanics of the swap, where the value was distributed and what it reveals about executing large trades against limited onchain liquidity.

Flow of Funds & Mechanics Behind the Swap

While the users goal was a simple conversion of $50M in USDT to AAVE tokens, the result was more complicated. The action involved a chain of protocols and asset conversions, from a lending protocol interface, to an aggregator, DEXs and entities involved in maximal extractable value (MEV).

The transaction began as a collateral swap through Aave’s interface, where the user held a position in aEthUSDT. This is an interest bearing deposit token (aToken), representing USDT deposited on Aave V3 (check out our recent report on Aave for more on this). To convert this collateral position, the Aave interface routed the order through CoW Protocol, a third‑party DEX aggregator that uses solvers (entities such as market makers or algorithmic bots) to find execution paths across liquidity venues.

Source: Coin Metrics ATLAS & Talos Research

In this case, the winning solver swapped the redeemed USDT into wrapped ETH (WETH) on Uniswap V3, then routed that WETH into a low liquidity SushiSwap AAVE/WETH pool where most of the value was lost. Using Coin Metrics ATLAS, we can trace the flow of funds through each leg of this transaction in block 24,643,151 and see where value was lost.

DEX Trade Route

1. aUSDT burned, USDT redeemed: The user’s 50.43M aEthUSDT is sent to CoW’s GPV2Settlement contract, which redeems it through Aave V3, burning the aToken and releasing the underlying 50.43M USDT from the reserve.
2. USDT → WETH through Uniswap V3: The CoW settlement contract sends the 50.43M USDT into the Uniswap V3 USDT/WETH pool, receiving 17,957.81 WETH (~$38.2M) in return.
3. WETH → AAVE through SushiSwap: The 17,957.81 WETH (~$38.2M) is routed into the SushiSwap WETH/AAVE pool, which held just ~$73K in liquidity at the time. Due to illiquidity for such a large swap, it returned only 331 AAVE (~$36K) to the user. A vast majority of the value was lost in this leg.

Source: Coin Metrics ATLAS

The same block also attracted maximal extractable value (MEV) activity. MEV refers to profit extracted by bots that monitor pending transactions and exploit large or predictable orders. In this case, a sandwich attack positioned a bot on both sides of the user’s trade to monetize the mispricing created in the SushiSwap pool.

Surrounding MEV

1. Front-run: An MEV bot (0x06cf...5ef) flash-borrows 14,175 WETH from Morpho and routes it through Bancor to acquire 128.57 AAVE. This pushes the price up before the user’s trade reaches SushiSwap.
2. Back-run: After the user’s order goes through at the inflated price, the bot sells 128.57 AAVE, receiving 17,912 WETH (~$40.9M) in return. After repaying Morpho’s flash loan (14,175 WETH), the remaining proceeds are split: ~13,087 WETH (~$29.9M) to Titan Builder as the block ordering fee, and ~4,824 WETH (~$10M) retained by the bot.

The entire operation involving the flashloan, frontrun, backrun and repayment all executed atomically in a single transaction, in the same block as the user’s swap.

Where did the value go?

Source: Coin Metrics ATLAS

The value did not vanish, but was redistributed to other participants in the block. As the diagram above shows, roughly $27M of the total ended up with Titan Builder as a block ordering payment, about $10M was captured by the MEV bot that sandwiched the swap, with only about $36K remaining in the user’s new AAVE position.

Large Trade Meets Low Liquidity

A large majority ($39M) of the value lost can be traced back to the SushiSwap WETH/AAVE pool, an AMM based liquidity pool on the SushiSwap DEX. Around the time of the swap, the pool had only ~$75K in total liquidity reserves against an outsized incoming trade of $37M. This near 500x mismatch proved to be too large for such an illiquid pool, resulting in severe price impact. As pool reserves shifted, Coin Metrics candles show that the price of AAVE in that market went from ~$118 (0.054 WETH/AAVE) to ~$306K (139.9 WETH/AAVE).

Source: Coin Metrics ATLAS & Market Data Feed

This raises questions of why a swap of this size was executed as a single trade, routed through such an illiquid venue and whether it should have gone through in the first place. A post-mortem released by Aave pointed to the illiquid market conditions and the fact that the user had explicitly accepted a 99.9% price impact warning. On the other hand, CoW Protocols analysis highlighted a compounding routing failure: a quote‑verification system with a “stale gas ceiling” rejected better priced alternatives, and the winning solver ultimately routed the trade into the ~$75K pool.

Takeaways From this Incident

As seen above, the core issue was price impact from a very large trade size meeting shallow onchain liquidity, not a protocol bug or exploit. The incident reveals broader lessons for on‑chain market structure and the industry at large:

• Protection at scale: For trades of this size, UX warnings may not be enough. Permissionless DeFi means protocols generally won’t block bad trades, but this incident highlights room for execution filters, pool‑level checks, or size caps in extreme cases, and raises an open question about where guardrails should sit between access and protection.
• Execution for large trades: Large orders like this $50M one are better split across time and venues using TWAP or algorithmic execution, which reduces market impact and MEV exposure. These practices are well established in traditional markets and are becoming equally important onchain.
• The role of data: Real‑time data on pool/market depth, cross‑venue liquidity, and slippage is critical for pre‑trade checks that can exclude ultra low‑liquidity venues. Embedding this into routing logic and risk filters can help prevent similar episodes as onchain markets scale and fragment.
• MEV and the trade‑offs of permissionless execution: Open mempools naturally invite MEV strategies like sandwiching. Designing around that reality, via private or protected execution channels, MEV‑aware routing, and opt‑in protection, will be key to preserving permissionless liquidity while limiting user risk.

‍

‍

‍

‍^{Disclaimer: The information herein is provided for informational purposes only. Talos Trading, LLC and its affiliates (“Talos”) does not give any representations or warranties in relation to the accuracy, validity, or completeness of the information of this material, including without limitation the factual information obtained from publicly available sources considered by Talos to be reliable at the time. Talos accepts no liability for any consequences of using the information contained in this material. Any opinions or estimates expressed herein reflect a judgment made by the author(s) as of the date of publication and are subject to change without notice. Neither this material nor any copy thereof may be taken, reproduced, or redistributed, directly or indirectly, without Talos’s prior written permission. Any views or opinions expressed are those of the authors and do not necessarily reflect the views of Talos. This communication does not constitute an offer to buy or sell, or a promotion or recommendation of, any digital asset, security, derivative, commodity, financial instrument, or product or trading strategy. This document and information are not intended to constitute investment advice or a recommendation to make (or refrain from making) any kind of investment decision and may not be relied on as such.}

Subscribe

If you’d like to get State of the Network in your inbox, please subscribe below.