Tuesday, March 17, 2026

Someone had $50 million sitting in Aave, not parked, earning.

Yield-bearing aEthUSDT, the kind of position that prints while you sleep.

March 12, 2026, they decided to rotate it into aEthAAVE. Same protocol, different token. A collateral swap. Routine, for a certain kind of whale.

Except they did it on their phone, through Aave's interface, which routed the trade through CoW Protocol. Which found a path, which ended in a SushiSwap pool so thin it had no business touching a trade this size, and yet, technically, it could.

The interface showed a warning. Then showed another warning. Required them to check a box confirming they understood. They checked it.

Fifty million dollars and a thumb tap later, they ended up with 327 AAVE, worth roughly the price of a used car (Just under $37k), and the rest of the ecosystem was already fighting over the carcass.

327 Aave for $50 million, pretty sure someone deserves a Darwin Award.

Nobody stole anything. Every contract executed cleanly. Every warning appeared as designed. And a free tool built by DefiLlama would have stopped this trade cold.

If a $50 million transaction needs a checkbox to proceed, what exactly is the checkbox protecting, the user, or the protocol?

Read more »

We provide an anonymous platform for whistleblowers and DeFi detectives to present their information to the community. All authors remain anonymous. 
We are all rekt.