Trader Loses $2M in Same-Block Backrun Extraction Exploit

A decentralized exchange swap worth $2.01 million ended in a steep loss for one trader after a liquidity router routed the trade through a thin market, enabling an Ethereum block builder to capture profits from a same-block arbitrage. According to GoPlus Security, the order effectively turned into a “backrun extraction” rather than a fair swap outcome—one that left the victim with only about $14,500 in the resulting tokens.

The episode highlights how maximal extractable value (MEV) activity and routing mechanics can combine to produce outsized losses when trades are executed through low-liquidity pools. It also underscores a practical lesson being shared in the community: users should review the transaction route before signing DEX actions, not just confirm the trade.

Key takeaways

• A $2.01 million ETH swap on a DEX resulted in a near-total value drop, landing at roughly $14,500 after execution via a low-liquidity pool.
• GoPlus Security described the event as same-block backrun extraction, not a conventional “sandwich” attack.
• Titan Builder was identified as the largest beneficiary, receiving about $1.8 million as a builder reward from the transaction.
• The victim’s route involved routing into an AVAIL/WETH pool that executed at around 120x the later sell price, enabling an imbalance to be monetized.
• Traders are being urged to verify swap routes before confirming, since clicking through without inspecting routing can lead to irreversible execution outcomes.

A swap that was rerouted into a low-liquidity trap

GoPlus Security said the trader swapped 1,126.44 ETH on Monday at 1:59 am UTC but received only 5,776 Lighter (LIT) tokens. The security firm framed the result as a “textbook case of same-block backrun extraction,” where the trade’s execution path created an exploitable price discrepancy within the same block.

In the assessment, this was not portrayed as a classic sandwich attack. Instead, the core mechanic was that a router directed the swap through a pool with insufficient depth, allowing another actor—working with block-building capabilities—to profit from the temporary mispricing and the order’s same-block lifecycle.

The incident was publicly discussed via on-chain analysis referenced in earlier community posts, including Lookonchain, and GoPlus’s commentary identifying the nature of the extraction.

How the route imbalance drove a ~99% loss

GoPlus Security’s breakdown points to the swap’s intermediate routing. The firm said the victim’s transaction routed roughly 1,117 ETH into a low-liquidity AVAIL/WETH pool on Uniswap v3. Once executed, the swap price was reportedly around 120 times higher than what the received AVAIL tokens could later be sold for.

That pricing mismatch becomes a leverage point when a trade is executed in a way that creates a temporary window for extraction. After the trader received nearly 6.67 million AVAIL tokens at an inflated price, the router involved—identified by GoPlus as “0x router”—reportedly sold a small amount of externally sourced AVAIL back into the same pool. The purpose, according to GoPlus, was to extract approximately 1,072 WETH before paying out 1,018 ETH, worth about $1.8 million, to Titan as a builder reward.

After these internal steps, the AVAIL was swapped for LIT tokens valued at roughly $14,200. That translated to a reported 99.3% loss for the trader, based on the amounts described in GoPlus Security’s analysis.

For users, the key takeaway is that the harm didn’t come from a smart contract “hack” in the typical sense. It came from execution conditions—specifically, routing into a pool where trade size relative to liquidity could severely distort outcomes, while MEV-aware infrastructure could monetize that distortion before the victim can unwind.

Why this is more than “just a bad swap”: MEV and routing mechanics

The episode fits a broader pattern in decentralized trading: as long as block builders can influence transaction ordering and routing can route through multiple liquidity venues, the same block can contain both the victim’s swap and the counter-trade needed to extract advantage from temporary imbalances.

The article’s framing also connects the event to ongoing concerns about MEV bots and liquidity routers atop a landscape that already faces risks from scams and exploits. While the details here are specific, the implication is general—traders may believe they are placing a straightforward order, but routing behavior and transaction ordering can turn the execution into a target.

From an investor or trader perspective, this means diligence has to extend beyond token and protocol selection. Execution parameters—including route, intermediary hops, and whether a swap is likely to interact with thin liquidity—can determine whether the trade results in the expected price or in an unfavorable extraction scenario.

Community warning: read the route before you click confirm

In response to incidents like this, crypto trader Ruslan Khairullin advised that traders should read the transaction route before signing the transaction. He described the event as what happens when someone “clicked confirm faster than you read the route,” calling it a “painful lesson” after the fact.

This kind of guidance is practical because it targets the behavioral failure mode: users often focus on the expected output shown by interfaces while ignoring what the route actually does under the hood. In low-liquidity conditions, the route’s intermediate steps can matter as much as—if not more than—the end pair.

Where the mechanics are especially risky is when routing can pull a large trade into a pool with limited depth, because the price impact can be severe enough to create an exploitable imbalance. If the resulting swap path lets MEV-capable actors profit within the same block, victims may not have a straightforward opportunity to recover at a reasonable price.

Titan Builder’s role and what to watch next

GoPlus Security identified Titan Builder as the biggest beneficiary, stating it received about $1.8 million from the transaction as a builder reward. Cointelegraph reported that it reached out to Titan but did not receive an immediate response. Separately, DefiLlama data shows Titan has made $112.6 million in revenue from block building services this year.

The firm’s profitability is not limited to this case. Cointelegraph noted that Titan’s biggest day this year came in March, when it extracted around $34 million in arbitrage profit from a MEV bot incident involving the CoW Protocol.

For market participants, the immediate question is not whether these mechanics exist—they do—but how often they are triggered by routing into low-liquidity pools and whether future tooling will make route inspection easier for ordinary users. The next developments to watch are whether DEX interfaces or aggregators tighten route transparency by default and whether users get better warnings when a trade path passes through thin liquidity that could be targeted by same-block extraction.