What Are Sandwich Attacks Costing DeFi Users?

Sandwich attacks have emerged as one of the most alarming vulnerabilities in decentralized finance (DeFi), enabling attackers to siphon value from users during token swaps. In a high-profile case on March 12, 2025, a trader attempted a $220,764 USDC→USDT swap on Uniswap v3—and ended up with just $5,271 due to a MEV bot executing a sandwich attack, netting over $215,500 in profits.

These attacks are far from rare. Sandwiched between your own transaction, two malicious ones—a front-run and a back-run—slip through the mempool’s transparency to manipulate prices. By the time your trade executes, the attacker has already inflated costs and drained value. This guide explains how sandwich attacks work, outlines real-world financial losses (with research), flags to watch for, and best practices to defend your assets. Awareness is your first line of defense.

What are Sandwich Attacks?

A sandwich attack is a type of front-running strategy in decentralized finance (DeFi) that exploits the time gap between a user submitting a transaction and that transaction being confirmed on-chain. In a typical sandwich attack, an attacker places two transactions—one before and one after the target user's transaction—hence “sandwiching” it. This allows the attacker to profit at the user's expense by manipulating token prices.

How It Works in Context

These attacks take advantage of the mempool, the waiting area for unconfirmed blockchain transactions. When a user sends a transaction to a DeFi protocol (like a token swap on Uniswap), it briefly sits in the mempool. Attackers monitor this space in real time, identifying high-value transactions with adjustable slippage limits.

The attacker then:

1. Front-runs the victim by placing a buy order, causing the token price to rise.
2. Allows the victim’s trade to execute at the inflated price.
3. Back-runs with a sell order, profiting from the artificially increased price.

This technique results in the user receiving fewer tokens than expected while the attacker earns the difference.

According to CoinMarketCap Academy, sandwich attacks are categorized under Miner Extractable Value (MEV) strategies—exploits that leverage miner or validator control over transaction ordering.

This form of manipulation is particularly prevalent on Automated Market Makers (AMMs) like Uniswap, SushiSwap, and PancakeSwap, where prices are governed by smart contract formulas and slippage plays a critical role in trade execution.

How Sandwich Attacks Work

Understanding the inner mechanics of sandwich attacks is key to recognizing and avoiding them. Here's a step-by-step breakdown of how a typical sandwich attack unfolds within an Automated Market Maker (AMM) environment like Uniswap:

Step 1: Victim Transaction Broadcast

A user submits a transaction to swap Token A for Token B via a DeFi platform. This transaction enters the mempool, where it’s temporarily visible before being added to the blockchain.

Step 2: Front-Run by Attacker

A malicious actor detects this pending transaction and submits a similar buy order for Token B, but with a higher gas fee. This incentivizes validators to confirm the attacker’s transaction before the victim’s, pushing up the token’s price.

Step 3: Victim Transaction Executes

The user’s transaction goes through, but now at a higher price due to the attacker’s front-run. As a result, the victim receives fewer tokens than expected, and the swap is less favorable.

Step 4: Back-Run Sell

Immediately after the victim's transaction, the attacker executes a sell order for Token B. They profit from the price spike they just caused, leaving the victim with a worse trade and higher slippage costs.

The Financial Toll of Sandwich Attacks

While sandwich attacks might seem like minor technical exploits, they have led to millions of dollars in confirmed losses, eroding trust and security in DeFi protocols.

Case Study: $215,000 Loss in Seconds

On March 12, 2025, a trader attempted to swap $220,764 in USDC for USDT on Uniswap v3. A malicious bot executed a textbook sandwich attack—buying just before and selling just after the victim’s trade—netting a profit of $215,500. The victim was left with only $5,271 in USDT.

Source: Etherscan

Aggregated Losses and MEV Exploits

According to EigenPhi, a research platform analyzing on-chain behavior, there have been:

• Over 72,000 confirmed sandwich attacks
• $1.4 million in total profit extracted from victims via these strategies

Another notable case occurred in early 2024:

• $714,000 was siphoned from six users in just five minutes via a cluster of sandwich attacks executed across multiple DEXs.

These numbers likely underrepresent the true scale of the problem, as not all transactions are analyzed for MEV behavior, and many victims remain unaware they’ve been targeted.

Red Flags & Risk Factors

To protect yourself from sandwich attacks, it's crucial to recognize the conditions that make you a likely target. While no strategy offers complete immunity, avoiding high-risk behaviors can drastically reduce your exposure.

1.High Slippage Tolerance

Slippage refers to the difference between the expected and executed price of a trade. Setting a high slippage tolerance (e.g., 5% or more) gives attackers a large profit window. Many DeFi wallets default to a low slippage (around 0.5%), which is safer for typical trades.

2.Large Trade Sizes

Big swaps attract attackers because the price movement is more significant, offering better profit margins. Breaking large trades into smaller parts can reduce the incentive for an attack.

3.Low-Liquidity Pools

Trades in thin liquidity pools are more susceptible to price manipulation. The less liquidity available, the easier it is for attackers to shift token prices and profit from slippage.

4.Public Mempool Visibility

Because all Ethereum transactions are broadcast to the public mempool before confirmation, bots can freely scan pending transactions. This transparency, while core to blockchain's openness, is a double-edged sword that enables sandwich strategies.

5.AMM-Based DEXs

Protocols using Automated Market Maker models—like Uniswap, SushiSwap, and PancakeSwap—are most vulnerable. Their pricing algorithms are deterministic and can be predicted and manipulated by smart bots.

Being aware of these risk factors empowers users to make more secure and informed trades. Up next: how to actively protect yourself from falling victim.

Protecting Yourself Against Sandwich Attacks

While sandwich attacks exploit the transparent and automated nature of DeFi, there are proactive strategies you can adopt to reduce the risk significantly. Here are proven techniques used by security-conscious traders:

1.Lower Your Slippage Tolerance

Reducing the slippage tolerance in your trade settings minimizes the range within which a transaction will execute. For most standard swaps, a setting between 0.1%–0.5% is sufficient. This narrower margin discourages attackers from sandwiching your transaction, as it limits their potential profit.

2.Split Large Transactions

If you're executing a high-value swap, divide it into several smaller transactions. This reduces the price impact and makes each individual transaction less appealing to MEV bots. Smaller swaps are more likely to fly under the radar.

3.Trade in High-Liquidity Pools

Opt for pools with deep liquidity. Greater liquidity dilutes the impact of any single trade, making price manipulation more difficult and unprofitable for attackers.

4.Use Private Transactions or MEV Blockers

Platforms like Flashbots Protect allow you to send transactions through a private mempool, shielding them from public visibility and MEV bots. Many wallets and DEXs now offer MEV protection toggles or integrations with relayer services.

5.Set Gas Fees Carefully

Bots often exploit low-gas transactions because they’re easier to front-run. Consider manually adjusting your gas fee to ensure fast confirmation and avoid getting sniped by front-running algorithms.

These techniques are essential tools for navigating DeFi safely. While they don’t eliminate all risk, they make your trades significantly harder to exploit.

Tools and Protocol-Level Solutions

Beyond individual tactics, the DeFi ecosystem is actively working to mitigate sandwich attacks at the protocol level. Several innovations aim to prevent MEV-related exploits through infrastructure changes and privacy enhancements.

1.Flashbots Protect and Private Mempools

Flashbots Protect enables users to send transactions through a private mempool that isn’t visible to traditional MEV bots. Instead of broadcasting transactions publicly, they are submitted directly to miners or validators via trusted relays. This prevents front-running and sandwiching by hiding trade details until inclusion in a block.

2.MEV-Aware DEXs

Some decentralized exchanges are now integrating MEV protection into their architecture. For example:

• CoW Swap uses batch auctions to prevent sandwiching by matching trades in bulk.
• MEVBlocker tools filter harmful sandwich transactions and reroute them.

3.On-Chain Detection and Monitoring

Research tools like GasTrace and EigenPhi help track and analyze suspicious MEV activity. These systems use algorithmic detection with accuracy rates exceeding 96.7% to flag sandwich-like behavior in real time.

These technologies mark a turning point—shifting from passive defense to proactive prevention. As more platforms adopt MEV-aware infrastructure, the frequency and profitability of sandwich attacks should decline.

Future Outlook

The arms race between MEV attackers and DeFi users is ongoing, but the tide may be turning. Several promising developments are reshaping the landscape:

1.Validator Incentive Reforms

Ethereum and Layer 2 rollups are exploring ways to realign validator incentives, discouraging participation in harmful MEV extraction.

2.AMM Redesign

New automated market maker models—such as concentrated liquidity (Uniswap v3) and batch auction systems (CoW Swap)—help reduce predictability and minimize slippage exploitation.

3.Layer 2 and Rollup Benefits

Layer 2s like Arbitrum and Optimism are developing closed mempool systems, where transactions are bundled and executed with limited public exposure, thereby minimizing front-running risk.

4.AI-Enhanced Threat Detection

Machine learning is increasingly being used to monitor mempool traffic and flag anomalous transaction sequences indicative of sandwich attacks, improving user alerts and platform-level blocking mechanisms.

The next wave of innovation will likely blend smart contract design, transaction obfuscation, and decentralized governance to counter MEV manipulation more comprehensively.

Final Thoughts

Sandwich attacks are a persistent threat in the DeFi ecosystem, preying on unsuspecting traders through sophisticated front-running tactics. However, by understanding how these attacks work, recognizing the warning signs, and adopting protective strategies—like slippage control, trade splitting, and using private mempools—you can drastically reduce your risk.

More importantly, the DeFi community is mobilizing. With protocol-level defenses, detection tools, and regulatory scrutiny on the rise, the long-term future looks more secure.

Vigilance, transparency, and innovation are key to defending DeFi from the shadows of MEV exploitation.