Crypto attacker drains $500K from victim’s wallet, then loses $370K to an MEV bot

There’s a certain poetic justice when a thief gets robbed. An attacker who drained roughly $501,650 in USDC from a victim’s wallet on the Base chain ended up keeping only about $129,000 of it, after a maximal extractable value (MEV) bot sandwich-attacked the swap transaction and pocketed approximately $370,000 in profit. The phishing attack occurred around 02:29 UTC on August 6, with the stolen funds moving to an attacker-controlled address within moments. What happened next turned a straightforward heist into one of the more entertaining on-chain dramas in recent memory. How the attacker outsmarted a victim but not a bot After securing the $501,650 in USDC, the attacker attempted to convert the stablecoin haul into wrapped ETH through a Uniswap V4 swap. This is standard operating procedure for crypto thieves: move stolen funds into a more liquid, harder-to-freeze asset as quickly as possible. The problem? The attacker apparently executed the swap without setting proper slippage protection. Slippage controls are essentially price limits that prevent a trade from going through if the execution price deviates too far from expectations. An MEV bot spotted the unprotected swap sitting ...