The projects Aave and CoW Swap have offered differing accounts of an incident in which a user lost over $50 million during a token exchange.
CoW’s Account
The aggregator’s team believes the failed transaction with AAVE was due to a combination of factors:
- a “fill or kill” order on an illiquid pair with a massive volume;
- an outdated gas limit in the verification system;
- a solver unable to execute the transaction;
- a potential data leak from the private mempool.
— CoW DAO (@CoWSwap) March 14, 2026
During the quote request stage, three solvers offered prices. The best of these suggested about $5 million AAVE for $50 million — a loss of around 90%. The verification system, with a strict limit of 12 million gas (outdated code, as explained by CoW), filtered out these options.
The only quote that passed verification from Solver A offered approximately 329 AAVE — 150-200 times worse than the unverified alternatives. This formed the basis of the order’s limit price.
Upon execution, the situation worsened. Solver E found a more advantageous route and won two auctions, but no transaction was included in the block. After two failures, it ceased participation, leaving only a weak solver with the worst price in play.
“The auction lacks a mechanism to track such a scenario,” CoW noted.
Developers also noted a potential data leak from the mempool. The transaction was sent via private RPC, but it was marked “confirmed in 30 seconds.” This occurs if the transaction is spotted in the public queue before being included in a block. The investigation is ongoing.
Aave’s Account
Aave believes the main causes of the incident were market illiquidity and the user’s own choices. The report reconstructed the transaction route: the solver converted aEthUSDT to USDT via Aave V3, then exchanged it for WETH on Uniswap V3, and finalized the operation through a SushiSwap pool with only $73,000 in liquidity.
— Aave (@aave) March 14, 2026
The team noted: the widget displayed a warning “high price impact (99.9%)” and required a consent checkbox. The user confirmed the operation from a mobile device. The funds are still available to him, but he has not made contact.
In response, Aave launched Aave Shield. This new feature blocks any exchange operations with a price impact above 25% by default. The protection can only be disabled manually in the settings.
Previously, the project’s founder, Stani Kulechov, mentioned plans to return about $600,000 in fees. In the latest publication, the figure was adjusted to $110,368 (25 basis points). The accuracy of the amount is confirmed by CoW Swap aggregator metadata.
This sum has also become a point of contention within the Aave community. Since December 2025, governance participants have been unable to decide whether to allocate the funds to the general DAO treasury or to the address of developers from Aave Labs.
The MEV Factor
Notably, official publications do not mention MEV bots, which gained the most from the trader’s error. According to Arkham, the Titan Builder algorithm extracted about $34 million in ETH. Another bot gained $9.9 million from a successful sandwich attack.
Titan Builder extracted $34M worth of ETH out of this debacle
They immediately sent all proceeds to Coinbase https://t.co/B9j8p2czTD pic.twitter.com/5Ll8mZxiEB
— Emmett Gallic (@emmettgallic) March 12, 2026
CoW limited itself to mentioning a “significant backrun” and listed addresses, but did not use the term “sandwich” or disclose the mechanics. Meanwhile, CoW Swap’s integration was positioned as protection against MEV.
Back on March 10, Aave experienced an oracle failure. It led to erroneous liquidations of positions in the wstETH token amounting to about $26 million.