What happened
On November 7, 2023, an attacker took 1,047.16 WETH (about $1.97 million) from an unnamed MEV bot on Ethereum in one flash-loan transaction. The bot had a function, selector 0xf6ebebbb() according to CryptoPotato, that anyone could call to make it swap through Curve pools. The attacker borrowed 27,255 WETH from Aave V3 and used it to skew the WETH/WBTC price in Curve's USDT/WBTC/WETH pool. They then called the bot's function so that it swapped 1,339.84 WETH for only 6.95 WBTC at the distorted price. Reversing their own trade, the attacker recovered the loan plus the value the bot lost, repaid Aave and kept the difference. CryptoPotato reported that the bot's owner had withdrawn funds from the contract before the attack.
**On-chain references**
- Exploit transaction:
0xbc08860cd0a08289c41033bdc84b2bb2b0c54a51ceae59620ed9904384287a38 - Attacker address:
0x46d9B3dFbc163465ca9E306487CbA60bC438F5a2 - Victim bot contract:
0x05f016765c6C601fd05a10dBa1AbE21a04F924A5
How it happened
- The attacker's contract took a 27,255 WETH flash loan from Aave V3.
- By calling the bot's unprotected function, the attacker made the bot swap its own funds through Curve's 3pool and the USDT/WBTC/WETH pool.
- The attacker swapped the 27,255 WETH into the USDT/WBTC/WETH pool for about 476 WBTC, making WBTC very expensive in WETH terms.
- They made the bot swap 1,339.84 WETH into the pool at that skewed price, receiving only 6.95 WBTC.
- The attacker swapped the WBTC back for 28,315.79 WETH, repaid 27,268.63 WETH to Aave, and sent 1,047.16 WETH to
0x46d9...F5a2.
Protocol details
Evidence
- report @PeckShieldAlert incident report twitter.com
- transaction Etherscan transaction 0xbc08860c...87a38 etherscan.io
- address etherscan.io address 0x46d9…F5a2 etherscan.io
- analysis DeFiLlama defillama.com
- analysis MEV bot exploited for almost $2 million web3isgoinggreat.com
- analysis Exploited MEV Bot Incurs $2M Loss in Curve Pool Swaps: Data cryptopotato.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
