Trader

GoPlus Security

Security

Cannon

Lighter

A trader who swapped $2.01 million worth of Ether on a decentralized exchange has been left with just $14,500 worth of tokens after a router directed the order through a low-liquidity pool, allowing an Ethereum block builder to profit massively from a same-block arbitrage trade.
The trader swapped 1,126.44 of Ether (ETH) but only received 5,776 Lighter (LIT) tokens, in a “textbook case of same-block backrun extraction,” according to GoPlus Security.
“This was a real, highly imbalanced backrunner arbitrage, not a classic sandwich attack,” GoPlus Security said. Titan Builder was the biggest beneficiary, walking away with $1.8 million from the transaction, which took place on Monday at 1:59 am UTC.
<img alt="" height="614" src="https://s3-images.ctmedia.io/media/content/pasted-image-1915.png" width="693">Source: <a href="https://x.com/lookonchain/status/2073938207323111801" rel="noopener noreferrer nofollow">Lookonchain</a>
The incident is a reminder of the risks posed by <a href="https://cointelegraph.com/research/eip-8105-a-new-design-for-ethereums-encrypted-mempool" rel="noopener noreferrer nofollow">maximal extractable value</a> (MEV) bots and liquidity routers on top of <a href="https://cointelegraph.com/news/all-defi-unsafe-ai-security-debate" rel="noopener noreferrer nofollow">hackers and scammers,</a> which continue to <a href="https://cointelegraph.com/news/crypto-hacks-fell-47-percent-in-h1-but-ecosystem-is-no-safer-certik" rel="noopener noreferrer nofollow">run rampant</a> in the crypto industry.
<h2 id="don-t-sign-dex-transactions-blindly-trader-says">Don’t sign DEX transactions blindly, trader says</h2>
To reduce the risk of such incidents, crypto trader Ruslan Khairullin <a href="https://x.com/Rus_Khairullin/status/2074171421572333811" rel="noopener noreferrer nofollow">said</a> traders should read the transaction route before signing the transaction.
“This is what happens when you clicked confirm faster than you read the route. Painful lesson to see in a real time.”
<img alt="" height="290" src="https://s3-images.ctmedia.io/media/content/pasted-image-1916.png" width="691">Source: <a href="https://x.com/lukecannon727/status/2073963721412530371" rel="noopener noreferrer nofollow">Luke Cannon</a>
<h2 id="how-the-victim-lost-2m-to-a-bot">How the victim lost $2M to a bot</h2>
The victim’s swap routed approximately 1,117 Ether into a low-liquidity AVAIL/WETH pool on Uniswap v3, causing the trade to execute at roughly 120 times higher than what AVAIL could later be sold for, GoPlus Security said.
After the trader received nearly 6.67 million AVAIL tokens at an inflated price, the router involved, 0x router, sold a small amount of externally sourced AVAIL into the same pool to extract about 1,072 WETH before paying out 1,018 ETH, worth $1.8 million, to Titan as a builder reward.
The AVAIL was then swapped for $14,200 worth of LIT tokens, marking a 99.3% loss.
Related: <a href="https://cointelegraph.com/news/all-defi-unsafe-ai-security-debate" rel="noopener noreferrer nofollow">‘All DeFi unsafe’ claim sparks AI security debate after April hack surge</a>&nbsp;
Cointelegraph reached out to Titan but didn’t receive an immediate response.
Titan has now made $112.6 million in revenue from its block building services this year, <a href="https://defillama.com/protocol/titan-builder?groupBy=monthly" rel="noopener noreferrer nofollow">data</a> from DefiLlama shows.
Titan’s biggest day this year came in March when it extracted around <a href="https://cointelegraph.com/news/mev-bot-makes-10-million-in-crypto-swap-gone-wrong" rel="noopener noreferrer nofollow">$34 million in arbitrage profit</a> from a <a href="https://cointelegraph.com/research/flash-freezing-flash-boys-per-transaction-encryption-to-fight-malicious-mev" rel="noopener noreferrer nofollow">MEV bot</a> incident on the CoW Protocol.
<img alt="" height="526" src="https://s3-images.ctmedia.io/media/content/pasted-image-1917.png" width="990">Monthly change in Titan’s revenue since February 2025. Source: <a href="https://defillama.com/protocol/titan-builder?groupBy=monthly" rel="noopener noreferrer nofollow">DefiLlama</a>
Magazine: <a href="https://cointelegraph-magazine.com/chinas-107-bitcoin-memory-thief-bithumb-ceo-booked-asia-express/" rel="noopener noreferrer nofollow">China’s 107 Bitcoin memory thief, Bithumb CEO booked: Asia Express</a>

Trader loses $2M in ‘same-block backrun extraction’ exploit

Table of Contents

Cointelegraph

Other articles published on Jul 7, 2026

Join our free newsletter for daily crypto updates!