A criminal on the Base network pulled off a $500,000 USDC heist. The victim lost half a million. But the story doesn't end there. When the attacker tried to cash out, something far worse happened to them.
PeckShield caught the details. The attacker drained the wallet and held roughly 500,000 USDC. Standard exit plan: swap it for something else, convert to fiat, disappear. The problem was the swap itself. The attacker didn't set proper slippage limits, which in the defi world is like leaving your car running in a bad neighborhood with the doors unlocked.
An MEV bot spotted the unprotected transaction. MEV bots are essentially predatory algorithms that watch the mempool for juicy swaps and insert their own transactions before and after yours, capturing the price movement in between. It's called sandwiching. The bot front-ran the attacker's swap, moved the market against them, and back-ran it for profit. When the dust settled, the attacker got only about 67 WETH. That's worth way less than the 500,000 USDC they started with.
The irony is thick. Someone stole from a victim, then got immediately robbed by an automated system designed to exploit exactly this kind of sloppy transaction structure. No honor among thieves, and definitely none in defi. The attacker learned an expensive lesson about slippage protection, though probably not the lesson anyone hoped they'd learn.
