KyberSwap:
a major 2023 exploit on one product, a genuinely strong current position on the other.
We tore apart KyberSwap, a multi-chain DEX aggregator founded in 2017 that also runs its own concentrated-liquidity AMM (Kyber Elastic), across the same aggregator-adapted scorecard we've used for 1inch, Jupiter, and Rubic. From a genuinely strong, precisely-cited current position, roughly 31% of Ethereum's DEX aggregator volume as of 2026, ahead of CoW Swap and 1inch specifically on that chain, broad routing across 420+ liquidity sources, and a distinctive 2026 NEAR Intents integration, to what we can't set aside: on November 23, 2023, Kyber Elastic, the platform's own separate AMM product, suffered a reentrancy attack via a precision-rounding bug that drained $47-48 million and 90% of that product's TVL. We found a genuinely important, well-corroborated distinction worth treating with precision: KyberSwap's aggregator router was confirmed unaffected, and 100% of affected users were compensated through a disclosed Treasury Grant Program; and landed on a score the marketing page won't show you.
Our take, up front: KyberSwap is genuinely different from every aggregator we've reviewed so far in this series: it's both a meta-aggregator, routing across 420+ liquidity sources, and a liquidity source in its own right, via Kyber Elastic and Kyber Classic, its own concentrated-liquidity AMMs, founded in 2017 by Loi Luu and Victor Tran. Real, genuinely strong, precisely-cited current market position: roughly 31% of Ethereum's DEX aggregator volume as of 2026, ahead of CoW Swap (22%) and 1inch specifically on that chain (15%), a genuinely notable recovery given what happened in 2023. Real, genuinely distinctive dual architecture: Kyber's own solvers know its pool state internally, sometimes producing better routes than external aggregators querying Kyber's pools through the standard interface. Real, genuinely distinctive 2026 NEAR Intents integration, extending reach into intent-based routing. Real, functioning KyberDAO governance since a 2021 tokenomics redesign, with KNC holders staking to vote on protocol parameters; a trader using the aggregator specifically doesn't need to touch KNC at all. What we can't set aside: a real, genuinely severe, well-corroborated major incident. On November 23, 2023, Kyber Elastic, the platform's own separate AMM product, suffered a reentrancy attack exploiting a precision-rounding bug in its liquidity callback mechanism, resulting in $47-48 million in losses and a 90% drop in that product's TVL. Real, genuinely important distinction confirmed across multiple independent sources: KyberSwap's aggregator router, a separate product from Elastic, was not compromised. Real, genuinely strong, complete, disclosed incident response: a Treasury Grant Program distributed grants covering 100% of affected funds to all users who submitted an application. Real, honest, ongoing consequence multiple 2026 sources still describe directly: lasting reputational damage, with Elastic no longer the default choice for risk-averse users. Real, honest, precise distinction worth understanding: DeFiLlama's own data shows the aggregator shares no revenue with KNC holders specifically, while the separate Elastic AMM shares 10% of its own collected fees with stakers. We weighted all of it below.
Real, genuinely well-corroborated, confirmed major incident: on November 23, 2023, Kyber Elastic, the platform's own concentrated-liquidity AMM, suffered a reentrancy attack exploiting a precision-rounding bug in its liquidity callback mechanism, resulting in $47-48 million in losses and a 90% drop in that product's TVL. Real, genuinely important, well-corroborated distinction across multiple independent sources: KyberSwap's aggregator router, a separate product from Elastic, was confirmed unaffected. Real, genuinely strong, complete, disclosed incident response: a Treasury Grant Program distributed grants covering 100% of affected funds to all users who submitted an application. Real, honest, ongoing consequence multiple 2026 sources still describe directly: lasting reputational damage, with Elastic no longer the default choice for risk-averse users.
Pros
- Aggregator router confirmed unaffected by the 2023 Elastic exploit
- 100% of affected users compensated via a disclosed Treasury Grant Program
Cons
- Nov 2023: $47-48M exploit on Kyber Elastic; 90% TVL drop on that product
- Multiple 2026 sources still cite lasting reputational damage from the incident
Real, genuinely strong, precisely-cited current market position: roughly 31% market share of Ethereum DEX aggregator volume as of 2026, ahead of CoW Swap (22%) and 1inch specifically on Ethereum (15%), a genuinely surprising, well-sourced recovery from the 2023 incident. Real, genuinely broad routing across 420+ liquidity sources, though chain-count claims vary between our sources (17 vs. 25).
Pros
- ~31% of Ethereum aggregator volume, ahead of CoW Swap and 1inch on that chain
- Genuinely broad routing across 420+ liquidity sources
Cons
- Minor discrepancy on exact chain count (17 vs. 25) across sources
Real, genuinely disclosed, credible founders (Loi Luu, Victor Tran) since 2017. Real, functioning KyberDAO governance, with KNC holders staking to vote on protocol parameters. Real, honest, important precision worth noting: DeFiLlama's own data shows the aggregator specifically shares no revenue with KNC holders, while the separate Elastic AMM product shares 10% of its collected fees with stakers, a distinction worth understanding before assuming KNC benefits from aggregator activity.
Pros
- Disclosed, credible founders (Loi Luu, Victor Tran) since 2017
- Functioning KyberDAO governance since a 2021 tokenomics redesign
Cons
- No revenue share to KNC from aggregator fees specifically, per DeFiLlama's own data
Real, genuinely broad routing across 420+ liquidity sources and roughly 17-25 chains depending on the source. Real, genuinely distinctive 2026 NEAR Intents integration, extending reach into intent-based routing.
Pros
- 420+ liquidity sources across 17-25 chains
- Distinctive 2026 NEAR Intents integration
Cons
- Minor, unresolved discrepancy on exact chain count
Real, disclosed, functioning aggregator interface serving genuinely large, current trading volume. Real, honest, disclosed limitation: KyberSwap's own Elastic product carries genuine impermanent-loss and complexity risk common to any concentrated-liquidity AMM, on top of its specific incident history.
Pros
- Functioning, high-volume aggregator interface
Cons
- Elastic's concentrated-liquidity mechanics carry genuine complexity and IL risk
Real, disclosed, precise aggregator financials: $712,492 in fees over 30 days, with revenue retained fully by KyberSwap rather than shared with token holders on the aggregator side specifically. Real, honest, notable ceiling on Elastic's own fee tiers, reaching up to 1% on some pools, a meaningfully higher rate than several comparable platforms we've reviewed.
Pros
- Disclosed, precise aggregator financials ($712,492 in fees over 30 days)
Cons
- Elastic's fee tiers can reach up to 1%, notably high relative to comparable pools
Real, genuinely distinctive dual aggregator-plus-AMM structure, letting Kyber's own solvers route with direct knowledge of its pool state. Real, distinctive 2026 NEAR Intents integration. Real, disclosed automatic fee reinvestment on Elastic positions.
Pros
- Distinctive dual aggregator-plus-AMM architecture; automatic fee reinvestment on Elastic
Cons
- The dual structure adds real complexity relative to a pure aggregator
Access only through KyberSwap's official app, and treat the aggregator and Elastic as separate risk decisions.
Given the 2023 exploit hit Elastic specifically, feel comfortable using the aggregator on its own merits, but size any Elastic liquidity position with real caution and consider diversifying across multiple concentrated-liquidity platforms rather than concentrating in one.
Two products under one brand, and a score that has to hold both truths at once.
KyberSwap is a genuinely instructive case for this series: it's the first platform we've reviewed where the aggregator and the liquidity source are the same company but functionally separate products, and the evidence treats them that way too. The aggregator's current standing is genuinely strong, a precisely-cited 31% of Ethereum's aggregator volume, ahead of 1inch on that specific chain. That's real, and it deserves real credit. But we don't think a brand gets to fully separate itself from its own history just because the org chart says two products. Kyber Elastic's 2023 exploit is one of the larger incidents we've documented in this entire project, and multiple 2026 sources still describe real, lasting reputational damage from it. The complete compensation and the confirmed isolation of the aggregator are both genuine, meaningful mitigating facts, not full absolution. We think the fair score sits in the middle: better than a platform that mishandled its own incident, but behind the two aggregators in this series with genuinely clean track records.
The scorecard above is deliberately general. Whether KyberSwap is right for you depends heavily on which of these you already are.
The Ethereum trader who wants the aggregator's genuinely strong current routing and market position specifically
This is where the platform's real, current strength concentrates most clearly, separate from Elastic's history.
The trader interested in the dual aggregator-plus-AMM architecture and its internal pool-state advantage
This genuinely distinctive design is a real, if complex, differentiator worth understanding.
The liquidity provider who researches Elastic's 2023 incident directly before committing meaningful capital
Given the severity of what happened, this specific diligence step is a genuinely reasonable one here.
Liquidity providers seeking the cleanest possible security record with no incident history to research
Orca or PancakeSwap, reviewed earlier in this series, are the better fit for this specific priority.
The scorecard covers the headline judgment calls. These four tables cover the specifics we didn't want to bury in prose; the November 2023 exploit explained precisely, the two-product revenue-sharing distinction, current market share standing, and our first four-way aggregator comparison.
The November 2023 Elastic exploit, precisely
| Detail | |
|---|---|
| What was hit | Kyber Elastic, the platform's own concentrated-liquidity AMM; the separate aggregator router was unaffected |
| Mechanism | Reentrancy exploiting a precision-rounding/math bug in liquidity callbacks |
| Amount | $47-48 million |
| TVL impact | ~90% drop on the Elastic product specifically |
| Compensation | 100% of affected funds distributed via a Treasury Grant Program to all applicants |
We found this "aggregator unaffected" distinction confirmed consistently and specifically across multiple independent, technically-detailed sources, including real-time reporting from the day of the incident.
Two products, two different revenue models
| KyberSwap Aggregator | Kyber Elastic (AMM) | |
|---|---|---|
| Revenue share to KNC | 0%, per DeFiLlama's own data | 10% of collected fees to stakers |
| Fee structure | Retained fully by KyberSwap | Tiered: 0.008%, 0.01%, 0.04%, 0.3%, 1% |
| 2023 incident impact | Unaffected | $47-48M exploit |
Understanding which specific product you're using, and which one KNC actually benefits from, is genuinely important here given how closely the two are marketed together.
Ethereum aggregator market share, 2026
| Platform | Ethereum aggregator share |
|---|---|
| KyberSwap | ~31% |
| CoW Swap | ~22% |
| 1inch | ~15% |
This figure is Ethereum-specific, not a measure of overall multi-chain dominance; 1inch's own broader, multi-chain volume remains far larger in absolute terms across all the chains it supports.
Four aggregators, side by side
| 1inch | Jupiter | Rubic | KyberSwap | |
|---|---|---|---|---|
| Own liquidity source? | Optional (1LP) | No | No | Yes (Elastic/Classic) |
| Confirmed incidents | One (2025, resolver) | One (2024, phishing) | Two (2022, admin-key) | One (2023, Elastic AMM) |
| Incident scale | ~$5M | ~$50M (user-side) | ~$35M combined | $47-48M |
| Compensation | Not specifically disclosed | Not applicable (user-side) | Not specifically disclosed | 100% via Treasury Grant Program |
KyberSwap's dual aggregator-plus-AMM structure makes it the only platform in this specific comparison where the aggregator and the affected product are genuinely separable, and its full compensation outcome is the most complete disclosed response we've found among this group.
We don't just want to hand you our number; we want to show you how it sits next to what other review desks and comparison sites have published. We've excluded two incident-specific reports (Hacken and The Block's real-time coverage of the 2023 exploit) since they're security postmortems rather than general platform reviews.
Our score lands modestly below the aggregated industry average; most general sources credit the aggregator's strong current market position clearly, while giving comparatively less weight to the ongoing reputational drag of the 2023 Elastic exploit than our methodology does.
| Source | Score | Type |
|---|
Scores compiled by our editorial team from publicly available reviews as of August 2026. "Editorial estimate" means the outlet didn't publish a single numeric score, so we converted their published verdict and sentiment into a comparable 100-point figure. Verify current figures directly with each source before citing them elsewhere.
Yes, on November 23, 2023, Kyber Elastic, the platform's own concentrated-liquidity AMM, was hit by a reentrancy attack resulting in $47-48 million in losses. KyberSwap's separate aggregator router was confirmed unaffected.
Both, and that's genuinely unusual for this category. KyberSwap runs a meta-aggregator routing across 420+ liquidity sources, plus its own concentrated-liquidity AMMs (Kyber Elastic and Kyber Classic), which serve as one of the many sources the aggregator can route through.
Yes. A Treasury Grant Program distributed grants covering 100% of affected funds to all users who submitted an application, one of the more complete disclosed compensation outcomes we've found in this project.
Genuinely large on Ethereum specifically: roughly 31% of Ethereum's DEX aggregator volume as of 2026, ahead of CoW Swap (22%) and 1inch (15%) on that particular chain.
No, not directly. DeFiLlama's own data shows the aggregator retains 100% of its fees with no revenue share to KNC holders. The separate Elastic AMM does share 10% of its own collected fees with KNC stakers.
It's been redeployed with updated, audited contracts since the 2023 exploit, but multiple 2026 sources still describe it as no longer the default choice for risk-averse liquidity providers. We'd recommend treating it with the same caution you'd apply to any concentrated-liquidity AMM with a real incident history.
Loi Luu and Victor Tran, in 2017, making it one of the longer-running platforms we've reviewed in this project.
A 2026 integration extending KyberSwap's routing into intent-based execution, a newer model where users specify a desired outcome and let a network of solvers compete to fulfill it, rather than routing a transaction directly themselves.
More Reviews
1inch – DEX Aggregator Review
Score: 75/100. Category-defining aggregator; a Mar 2025 resolver incident (~$5M) didn't touch user funds, but did touch trust.
Read More
Jupiter – DEX Aggregator Review
Score: 78/100. Highest score in this whole project: ~95% Solana share, with the one 2024 phishing incident purely user-side.
Read More
Rubic – DEX Aggregator Review
Score: 51/100. Lowest in this sub-series: two 2022 hacks and unresolved, wide gaps in its own claimed audit scope.
Read More
Rango Exchange – DEX Aggregator Review
Score: 69/100. Cleanest incident record we found in this whole series, undercut only by just two disclosed audits.
Read More