How Three Infrastructure Failures Turned a $50M Collateral Swap into $36K

At block 24,643,151, a single transaction converted 50 million dollars in Aave collateral into $36,000 worth of AAVE tokens. In the same block, an MEV bot extracted $36.9 million from the trade. A Lido validator earned $1.2 million for including the block. Titan Builder kept $33.6 million.

The user had confirmed a checkbox warning that said: “I confirm the swap with a potential 100% value loss.”

What happened between those two facts (the user clicking confirm and the extraction) is a cascade of three independent infrastructure failures. Any one of them, stopped, would have produced a completely different outcome. None of them were stopped.

What the user was actually trying to do

When you deposit USDT into Aave V3, you receive aEthUSDT: an interest-bearing position that appreciates automatically as borrowing fees accrue. It is not USDT. It cannot be directly swapped on a DEX. Moving between aToken positions (aEthUSDT to aEthAAVE, for example) requires a protocol-level primitive called a collateral swap.

The Swap Collateral Adapter V3 (0xadc0a53095a0af87f3aa29fe0715b5c28016364e) executes this atomically in a single transaction:¹

Flash loan borrows the collateral asset
User’s aEthUSDT is pulled (requires prior approval)
Underlying USDT redeemed from Aave V3 (1:1, no price impact)
USDT routed through CoW Protocol solvers to acquire AAVE
AAVE re-supplied into Aave V3 on the user’s behalf
User receives aEthAAVE
Flash loan repaid

All-or-nothing. Either every step completes in the same block, or the entire transaction reverts. The flash loan is not a risk; it is a mechanism.

The problem was step 4.

The three-hop routing path

CoW Protocol’s solver auction found a three-hop route for this order.

Hop 1, Aave V3 redemption: 50,432,688 aEthUSDT → 50,432,688 USDT (1:1, zero price impact)

Hop 2, Uniswap V3 USDT/WETH: 50,432,688 USDT → approximately 17,957 WETH (roughly $37M)

A large order on a relatively deep pool. Significant slippage, but the trade survived it. Uniswap V3’s concentrated liquidity absorbed the pressure.

Hop 3, SushiSwap AAVE/WETH: 17,957 WETH → 327 AAVE (roughly $36,000)

This is where the incident lives. The SushiSwap AAVE/WETH pool had approximately $73,000 in total liquidity at execution. A $37M WETH order entered it. The constant product formula does the rest: you buy the entire pool at progressively inflating prices until the pool is empty. The effective price paid: approximately $154,000 per AAVE, against a market rate of roughly $111. Price impact: 99.9%+.

Slippage tolerance is not the same thing as price impact

This distinction trips up engineers who haven’t thought carefully about it.

Price impact is the change in market price caused by the trade itself. It is baked into the quote shown to you before execution. When a $37M order hits a $73K pool, the impact is calculable from the pool’s reserves. It is not a surprise that emerges during execution. It is a property of the trade size relative to available liquidity.

Slippage tolerance is the maximum acceptable deviation from the quoted execution price. It protects against market movement between quote time and on-chain execution: another large trade landing first, a price oracle update, mempool delay. It does nothing when the base quote is already catastrophically bad.

The user’s slippage tolerance was 1.21%. That setting was functioning correctly.

In this case, the user sent a market order with the suggested 1.21% slippage. But the core issue wasn’t slippage, it was just the accepted quote with 99% price impact.

Martin Grabina, Aave engineer²

To be more precise, the issue wasn’t slippage, it was user accepting a quote with high price impact.

Stani Kulechov, Aave founder²

The CoW Protocol order quote showed fewer than 140 AAVE in exchange for 50 million USDT (before fees and slippage) and was visible on the CoW Explorer before a single unit of gas was spent. The 99%+ price impact was displayed. The user confirmed it.

But why was this the only quote available?

Three compounding infrastructure failures

CoW Protocol runs a competitive solver auction: multiple algorithms bid to find the optimal settlement path. The design intent is that competition between solvers produces better execution for users, with MEV-protection built in via delegated execution.³ On March 12th, the system failed three independent times, in sequence, before the auction settled on the $36K route.

Failure 1: The hardcoded 12M gas ceiling

CoW Protocol’s quote verification step rejected any route that exceeded 12 million gas units in simulation. Per CoW’s own post-mortem, this was “legacy code predating current gas consumption patterns.”⁴

Competing solvers had found better routes. Routes that would have returned approximately $5–6 million in AAVE (still a dramatic loss from $50M, but orders of magnitude better than $36K). Those routes were rejected. Not because they were technically incorrect, but because they exceeded a hardcoded limit that nobody had updated.

The better routes never reached the user. The ceiling was fixed after the incident.

Failure 2: Solver E’s silent abandonment

A solver named “Solver E” won auction 12479347 with a superior route. It committed to the auction. It never submitted an on-chain transaction. No revert. No error message. Silence.

Solver E won the next auction (12479350) again with better execution. Again, no on-chain submission. Zero reverts observed.

After two silent wins and two silent non-executions, Solver E stopped bidding entirely. The auction system had no mechanism to detect this pattern: no alerting on won-but-not-executed auctions, no escalation path, no automatic fallback. Solver E disappeared, and the system continued routing to progressively worse bids from remaining solvers.

Solver B’s degraded route (the $36K option) became the winner in the absence of any competition that could actually execute.

Failure 3: The mempool leak

The transaction was submitted via a private RPC endpoint, intended to keep it invisible to the public mempool until block inclusion. This is the standard protection mechanism for large orders: keep the trade hidden until it is already in a block, giving MEV bots no opportunity to front-run or sandwich it.

Etherscan shows a “confirmed within 30 seconds” tag on transactions that appear in the public mempool before block inclusion. Transaction 0x9fa9feab3c1989a33424728c23e6de07a40a26a98ff7ff5139f3492ce430801f carries that tag.

The transaction leaked into the public mempool. An MEV bot saw it. The extraction follows directly.

Technically correct is not the ceiling we should be building toward.

CoW Protocol post-mortem⁴

The same-block MEV extraction

With the pending swap visible in the public mempool, an MEV bot constructed a backrun and executed it in block 24,643,151:

Flash-borrow approximately 14,175 WETH (roughly $29M) from Morpho. Zero collateral required; full repayment in the same block.
Buy AAVE on Bancor at roughly $111/token, establishing a position before the user’s WETH lands.
The user’s 17,957 WETH hits the SushiSwap AAVE/WETH pool (roughly $73K total liquidity). The pool drains. Effective price: approximately $154,000 per AAVE.
Sell AAVE into the now-distorted pool at inflated prices.
Execute 18 additional arbitrage trades across Uniswap, SushiSwap, Bancor, DODO, and Fluid to normalize prices and close out the position.
Repay the Morpho flash loan.
Net: approximately 4,824 ETH (roughly $9.9M) for the MEV operator.

The extracted value flowed outward from there:

Recipient	ETH	USD
Titan Builder (total received)	16,927 ETH	$34.8M
Lido validator (paid by Titan)	568 ETH	$1.2M
Titan Builder (net)	16,359 ETH	$33.6M
MEV bot operator	4,824 ETH	$9.9M
User received	-	$36,000
Aave frontend fees (planned refund)	-	$600K

This single transaction made Titan Builder the top on-chain revenue earner for that 24-hour period, ahead of Tether ($16.43M) and Circle ($6.85M).⁵

The Aave–CoW integration was described as providing “MEV-resistant execution.”⁶ The mempool leak bypassed that protection entirely. The MEV infrastructure performed exactly as designed.

What the warnings showed, and the design problem they expose

The Aave interface displayed four layers of warning before execution:

A high price impact warning (99.9%)
An extraordinary slippage alert requiring manual acknowledgment
An explicit confirmation checkbox: “I confirm the swap with a potential 100% value loss”
The CoW Explorer order quote: fewer than 140 AAVE for $50M USDT, visible before any gas was committed

The user confirmed all four on a mobile device. Both Aave and CoW Protocol acknowledged this in their post-mortems, and both framed the execution as permissionless: the user explicitly accepted the risk.

The community response was narrower than “user error” or “protocol failure.” It was a design question.

You need a more aggressive friction pattern than just a checkbox if they are about to lose over $100,000 in slippage.

James Dawson, design engineer⁷

A checkbox asks for confirmation. It does not slow down the decision, require deliberate re-entry, or apply asymmetric friction based on the magnitude of loss. At a $50M scale, “technically the warning was shown” and “the warning was sufficient” are different claims.

Aave’s response: Aave Shield, deployed as a new default that blocks swaps exceeding 25% price impact. Users who want to override must navigate to Settings and explicitly disable it.⁸ The architectural change is reversing the default: protection is on, risk acceptance requires a deliberate separate action rather than one checkbox in the swap flow.

The on-chain trail

Lookonchain traced the originating wallet through 13 addresses that withdrew USDC and USDT from Binance on February 16th and February 20th, all becoming active simultaneously on March 12th, and sharing Binance deposit addresses with wallets publicly linked to Garrett Jin.⁹ Jin’s connected wallets sold approximately 261,024 ETH ($543M) and 11,318 BTC ($761M) in the same period.

One theory circulated: an intentional value transfer, moving funds of unclear provenance through an apparent trading error into “clean” MEV extraction proceeds. The circumstantial case: a newly created wallet, retail-scale interface used for institutional-scale capital, mobile confirmation of explicit warnings, a single order that would have consumed roughly 3% of total AAVE supply.

The evidence is circumstantial. No formal accusation exists. As of the post-mortem publications, the user had not contacted either protocol.

The full picture is on-chain

The entire sequence is preserved at transaction 0x9fa9feab3c1989a33424728c23e6de07a40a26a98ff7ff5139f3492ce430801f, block 24,643,151 on Ethereum mainnet. The Swap Collateral Adapter’s internal call tree (Aave redemption, Uniswap V3 routing, SushiSwap execution) is embedded in the transaction trace. The MEV bot’s 18 arbitrage hops follow in the same block in sequence. Every flash loan, every token transfer, every pool interaction: on-chain and readable.

This is what block explorers do beyond showing transaction hashes. They render execution: decoded call trees, event logs, internal traces, value flows at each hop. For engineering teams running post-mortems on their own protocols (or building DeFi infrastructure that routes large orders), the ability to inspect a complex multi-hop transaction at full resolution is what makes “what actually happened” a question with a definitive answer. Ethernal connects to any EVM-compatible node, including Ethereum mainnet, and decodes exactly this.

Three independent infrastructure failures produced this outcome. The user made a bad decision on top of them. Both things are true.

The failures (the gas ceiling, the silent solver, the mempool leak) were fixable. They were fixed, after the fact. That’s the uncomfortable part.

References

1. Aave. “Swap Features.” aave.com, 2024. https://aave.com/docs/aave-v3/smart-contracts/swap-features

2. Grabina, M. and Kulechov, S. “Aave Community Post-Mortem.” The Block, March 2026. https://www.theblock.co/post/393621/aave-and-cow-swap-publish-dueling-post-mortems-after-50-million-defi-swap-disaster

3. CoW Protocol. “MEV Protection.” docs.cow.fi, 2024. https://docs.cow.fi/cow-protocol/concepts/benefits/mev-protection

4. CoW Protocol. “Official Statement on the $50M Swap Incident.” x.com/CoWSwap, March 2026. https://x.com/CoWSwap/status/2032265762916757614

5. CryptoRank. “Titan Builder Tops On-Chain Revenue After $50M Swap Error.” cryptorank.io, March 2026. https://cryptorank.io/news/feed/7c9f5-titan-builder-on-chain-revenue-swap-error

6. Aave. “Aave and CoW Swap: MEV-Resistant Execution.” aave.com, 2025. https://aave.com/blog/aave-cow-swap

7. Chainflip. “The $50M Swap That Exposed a Gap in DeFi Infrastructure.” blog.chainflip.io, March 2026. https://blog.chainflip.io/the-50m-swap-that-exposed-a-gap-in-defi-infrastructure/

8. CoinTelegraph. “Aave Rolls Out Aave Shield After $50M User Loss.” cointelegraph.com, March 2026. https://cointelegraph.com/news/aave-roll-out-aave-shield-after-50m-user-loss

9. Lookonchain. “On-Chain Tracing of the Originating Wallet.” x.com/lookonchain, March 2026. https://x.com/lookonchain/status/2032293192201277894