MEV Myth Buster #6: Impact of Exploits Ripples Across the Board via Composability
How a $1.5 B Bybit Breach Warped Prices in 22 Pools, Spawning 11 Arbitrages in One Block.
🦄 Myth
Exploits Only Hurt the Pool They Hit.
Many traders assume that when an exploit drains one pool, the damage—and any MEV—stops there.
They fail to understand that DeFi’s composability causes chain reactions in unexpected ways, like what we observed after the $1.5 billion ByBit hack.
🧠 What Happened
On 21 Feb 2025 @ 14:13 UTC, a $1.5 B exploit struck ByBit. In 2 hours. The hacker’s money laundering triggered the following arbitrages. In Block 21895553, the exploiter’s swapping 15K stETH for ETH via Dodo impacted prices across Curve, Balancer, Uniswap, and PancakeSwap, leading to 11 arbitrages expanding to 22 pools.
This table illustrates the connections between 11 arbitrages and 22 pools after the hacker's swap. Different colors mark different bots working across various pools.
Column headers indicate the pools involved in a transaction. The numbers in front of each row indicate the positions of each transaction. Cells mark the contracts or bots. For example, in Row 1, which is the transaction on position 1 of Block 21895553, bot 0x9d6b finishes the arbitrage between three pools: Curve sETH/ETH, Balancer pxETH/WETH, and Curve pxETH/stETH.
🔬Microstructure
For the sake of clarity, we choose the exploiter’s swap on Pos 0 and the following arbitrage on Pos 1, and simplify them in the chart below.
🧬 Key Steps Breakdown
In the transaction on Pos 0, the hacker sent 15K stETH to the Dodo router first. Then the router managed a series of exchanges on stETH(wstETH) for ETH(WETH), among which the biggest swap was done via Curve, trading 13.4K stETH for 15.1K ETH.
The grand trade on Curve created the price discrepancy, which Searcher 9d6b detected through a private channel and actioned in the transaction on Pos 1.
In their arbitrage, Searcher 9d6b flash-loaned 634.6 WETH from Morpho, then they reverse-swapped ETH for stETH in the same Curve pool, exchanged stETH for pxETH via Curve, and finished their arbitrage via trading pxETH for WETH via Balancer.
In the end, Searcher 9d6b made 1.4 ETH after tipping the builder 0.04 ETH.
🧑🤝🧑Key Entities
ByBit Hacker is the one making the whole arbitrage chain possible.
Dodo Router’s algorithm splits the grand order of the hacker into different pools on different protocols due to the composability APIs they provide.
Searcher 9d6b demonstrated their acuteness in discovering the opportunity in the blink of an eye.
Morpho’s flash loan feature enabled Searcher 9d6b to execute the arbitrage with little capital.
🔁 Not a Fluke
9d6b didn't stop there. It executed seven more backruns, using 15 different pools for a total profit of $12K.
But there's a catch. By splitting into multiple transactions, 9d6b revealed room for algorithmic improvement. A more optimized approach would have used fewer transactions, saving gas and eliminating opportunities for competitors.
Indeed, Bots 4c99 and 12e3 picked up the leftovers, earning $79 across three transactions—a perfect illustration of MEV's ripple effect.
Bot 4c99 used the same pools as the hacker and 9d6b, and the bot 12e3 acted on the pool used by 9d6b, displaying the chain reaction.
However, these bots were not the biggest winners of the day. By fulfilling the hacker's limit orders selling 75K stETH for ETH, shown in the image below, Paraswap pocketed $440K in profit.
⚠️ Your Takeaway
Composability creates ripples across DEXes, implicating much broader audiences than expected.
Read all MEV Myth Buster series here:
All the MEV Myth Busters You Can't Miss
Behind every transaction is a battle-tested supply chain of searchers, builders, and validators—an ecosystem that rewards speed, creativity, and, sometimes, downright audacity. In this MEV Myth Busters series, we’ll dissect the real transactions that shatter people's comforting stories about DeFi.
You can click this link or open https://bit.ly/hfdefi to download the free ebook Head First DeFi, Decoding the DNA of Crypto Transactions & Strategies. We are adding more intriguing cases in 2024. Let us know if you want to be part of it.
Follow us via these to dig more hidden wisdom of DeFi:
EigenTx | Website | Discord | Twitter | YouTube | Substack | Medium | Telegram