KyberSwap User Lost Over $2 Millions While Swapping

A recent incident has caused a user of KyberSwap, a decentralized exchange, to lose a substantial amount of money. The user attempted to swap 3CRV LP tokens into USDT, but due to a misjudgment in slippage and a mysterious routing decision, they ended up receiving only $0.05 of USDT in exchange for $2,080,468.85 worth of 3CRV tokens. This incident highlights the risks associated with decentralized exchanges and the importance of being cautious while trading on them.

Key Highlights

• KyberSwap user loses millions due to misjudgment in slippage and mysterious routing decision
• Incident highlights risks associated with decentralized exchanges
• Users must exercise caution and familiarize themselves with exchange tools and features
• Exchanges must prioritize user safety and improve UI to prevent mishaps
• Let's work together to create a safe and secure ecosystem for cryptocurrency investors and users

The user in question used the KyberSwap aggregation router to trade a large amount of 3CRV LP tokens into USDT. The decision to use the aggregation router instead of withdrawing the LP tokens into USDT directly was questionable. However, the situation worsened when the user neglected to set the slippage correctly. As a result, they clicked on the "Swap" button without noticing that the rate being offered was too low.

The next step in the transaction involved the UniswapV2 pool 0x7d36fbd3, which had been dormant for 251 days with just $2 worth of liquidity. The fluctuating gas estimation caused all routes to fail except for 0x's, which offered a very poor rate. Unfortunately, KyberSwap displayed this rate to the user without indicating that it was significantly worse than the initial rate. The user signed off on the transaction, resulting in 2 million 3CRV tokens being exchanged for just 54,182 units of USDC, worth only 5 cents. The sudden influx of 3CRV tokens into the UniswapV2 pool caused it to become significantly imbalanced. An MEV bot intervened and exchanged 1.45 USDC for the 2 million 3CRV tokens in the pool, paying $45 in gas and $39k in MEV bribes. The bot made a profit of $2.045M by executing a relatively simple transaction.

KyberSwap has taken several steps to address the situation. They are currently in contact with the affected user to work on a resolution, and they are also reaching out to the bot creator, bot user, and Coinbase, among other parties, to help with the recovery of funds. Additionally, KyberSwap has updated its Confirm Swap UI to include a warning message if the new price is worse than the initial quote, asking the user to accept the new price before proceeding with the swap.
The incident involving KyberSwap and the UniswapV2 pool highlights the need for caution and awareness when using decentralized exchanges. Users must ensure that they understand the risks associated with such exchanges and exercise caution when trading. They must also be familiar with the tools and features provided by the exchange to minimize the chances of such incidents. Furthermore, exchanges must prioritize the safety of their users and continuously improve their UI to prevent such situations from occurring in the future. As cryptocurrency gains more mainstream acceptance, it is important that we work together to create a safe and secure ecosystem for users and investors alike.