Key takeaway: A crypto sandwich attack happens when an attacker tries to place trades immediately around a user’s decentralized-exchange swap to worsen the user’s execution price and capture value. Slippage settings, liquidity, and execution routing affect the risk, but no single setting eliminates it.
What is a sandwich attack?
A sandwich attack is a harmful form of maximal extractable value (MEV) activity in which an attacker attempts to place transactions before and after a user’s decentralized-exchange swap. The attacker buys or otherwise changes the pool price before the victim’s swap, lets the victim execute at a worse price, and then reverses the position after the victim. The victim may receive fewer tokens or pay more than the quote suggested. Not every price change is a sandwich attack, and not every MEV strategy is harmful; the mechanism is a particular manipulation of transaction ordering and automated-market-maker liquidity.
How decentralized exchange swaps create the opportunity
Many DEX liquidity pools use automated market-maker pricing. A swap changes the relative balances of assets in a pool, which changes the marginal execution price. Traders often submit swaps while tolerating some difference between the displayed quote and executed output. If a pending trade is visible in a public transaction pool, specialized searchers can estimate the size and price impact of that trade. On networks and routing paths where they can influence ordering, an attacker may target trades with enough value and slippage tolerance to cover the attacker’s trading fees, gas and other costs.
A step-by-step sandwich attack example
Imagine a trader submits a swap of an asset and expects to receive approximately 1,000 units of another token. The trade specifies a minimum acceptable output of 970 tokens, permitting a 3% shortfall against that quote. An attacker notices the pending swap, sends a transaction that moves the pool price against the trader, and arranges for the user’s transaction to execute after that price movement. The user receives, hypothetically, 975 tokensβstill above the 970-token minimum but worse than the initial quote. The attacker then sends a transaction reversing the earlier trade, seeking to capture a price difference. These figures illustrate the sequence, not a guaranteed profit or an actual transaction record.
What the attacker pays and why the attack can fail
Attackers face transaction fees, pool fees, price movements, competition and the risk that their preferred ordering is not achieved. The victim’s transaction may revert if the manipulated price would violate its minimum-output threshold. A failed attack might leave the attacker holding inventory or paying costs without the expected benefit. Some networks, routers and private execution paths reduce visibility or provide additional protective checks. These limitations matter because a large pending swap does not automatically imply that a sandwich attack will succeed.
Slippage versus price impact
Price impact is the expected change in execution price from trading against the available liquidity, while slippage describes the difference between an expected and realized execution price. Both can contribute to a disappointing trade, but their causes are not identical. A swap can have high price impact because a liquidity pool is shallow even if nobody attacks it. A sandwich attack deliberately worsens the price path through ordered trades. Compare the quoted output, selected slippage threshold, pool depth and on-chain transactions before attributing an unexpected price to an attacker. BlockBriefing’s slippage and price-impact guide explains the distinction in detail.
How slippage settings can affect exposure
A large maximum-slippage allowance can give an attacker more space to move the price while still allowing the user’s transaction to execute. Tightening the tolerance may limit acceptable adverse execution, but setting it too low can cause legitimate swaps to revert during normal volatility. There is no universally safe percentage: appropriate limits depend on liquidity, token transfer rules, network conditions and order size. Review the minimum amount you will receive in the transaction confirmation screen, not just the platform’s headline slippage percentage. A restrictive minimum-output rule is a protection, not a profit guarantee.
Why liquidity depth matters
For two similar swaps, the trade in a deeper, more liquid pool usually causes less price movement than the same trade in a thin pool, all else equal. That reduces one potential source of sandwich profitability. It does not eliminate attack risk, particularly for large orders or volatile assets. Before swapping, compare routed pools, expected output, fees, unusual token taxes and whether the quoted path crosses illiquid pairs. A tiny liquidity pool offering a seemingly attractive token price can be expensive to exit and may be vulnerable to multiple other forms of manipulation.
Private transaction routing and MEV protection
Some wallets and DEX interfaces offer protected swap execution or private transaction-routing systems designed to avoid publishing a transaction to the ordinary public mempool before inclusion. Uniswap market price and chart describes swap protection on certain 
Ethereum market price and chart mainnet transactions, and wallet functionality can differ by network and version. Private routing can reduce a common source of front-running exposure, but it is not a universal shield against every execution risk, validator behavior or smart-contract exploit. Verify whether protection applies to your specific chain, swap route and wallet rather than assuming every ‘private’ setting provides the same guarantees.
How to recognize a suspected sandwich attack
A common investigation pattern involves inspecting a swap in a block explorer and identifying related swaps in the same block before and after it. Analysts may compare token transfers, pool reserve changes, transaction indexes, searcher addresses and realized execution amounts. However, adjacent swaps are not sufficient proof on their own: ordinary arbitrage and unrelated activity can produce similar patterns. A rigorous analysis requires examining the actual ordering, contracts and economic flows. Users should be skeptical of tools claiming to detect every sandwich attack with certainty from a screenshot or token price chart.
Practical defenses for everyday traders
- Use the official exchange or wallet interface rather than an unverified link.
- Review the swap’s minimum received amount and price impact.
- Avoid excessively wide slippage tolerance when a tighter setting is practical.
- Consider deeper liquidity and reputable routing paths rather than thin pools.
- Use available documented MEV or swap protection where supported.
- For unusually large trades, consider splitting the order or using a suitable execution mechanism, while acknowledging added fees and market exposure.
- Inspect unexpected outcomes in a block explorer before attributing them to manipulation.
Are sandwich attacks the same as scams or failed transactions?
A sandwich attack is an execution-level manipulation, not necessarily a phishing attempt or malicious token contract. The affected wallet may remain under the user’s control while the user receives a worse swap price. By contrast, a wallet drainer often seeks unauthorized token approvals or malicious signatures, and an address-poisoning scam tries to induce a transfer to the wrong recipient. A transaction can also revert due to a price limit without anyone stealing wallet credentials. These distinctions help users choose appropriate responses. See BlockBriefing’s wallet-drainer warning signs and token-approval guide.
Frequently asked questions
Is every DEX swap vulnerable to a sandwich attack?
No. Exposure depends on the network, routing, order type, visibility, transaction inclusion and available liquidity.
Can a sandwich attack empty a wallet?
The typical sandwich mechanism worsens trade execution rather than directly obtaining a user’s private keys. Other exploits or scams can occur separately.
Does a lower slippage setting prevent every attack?
No. It can constrain acceptable adverse execution but may increase failed transactions and gas costs.
Is MEV always harmful?
No. Ethereum’s documentation distinguishes beneficial arbitrage and liquidation activity from harmful sandwiching and other exploitative strategies.
Primary technical sources and related reading
Sources: Ethereum.org’s MEV documentation, Uniswap’s sandwich-attack explanation, and Uniswap’s guidance on MEV protection. Related BlockBriefing education: what is DeFi, blockchain explorers, and cross-chain bridges.
Editorial note: This report provides education about DeFi market mechanics, not trading or investment advice. Examples are hypothetical; avoid treating suspected MEV activity as proven without transaction-level analysis. Product features can change by network and app version.
