In the 7 days to August 24, 2026, 9.29% of tracked Base DEX volume routed through contracts that no public label, no registry, and none of our own forensic passes can tie to a frontend or app. A week ago that figure was $205M. It did not triple because our labeling got worse: Base DEX volume roughly doubled this week, and we attributed a smaller share of the new flow than of the old. The five contracts named below stayed named: we identified $314M of it, including the contract this note was originally built around. Here is what we found, how, and what is still open.
ClearTrace attributes DEX volume to the party that actually sent it, using four independent vectors: calldata-suffix trapping, proxy-router tracing (where the transaction target is not the venue), multi-hop origin tracing, and fee-recipient attribution, backed by a forensic labeling pipeline (verified-source lookups across four chains, deployer attribution, bytecode and behavioral fingerprints). On Base that resolves 90.71% of tracked volume to a named origin: frontends, aggregators, market-maker desks, MEV bots, vault systems.
"Unattributed" is the residue, counted strictly. It includes contracts our own pipeline has examined and explicitly failed to identify; on July 30, 2026 we corrected our coverage metric because those "manual review" placeholders had been counted on the attributed side, which had flattered the number. Everything named below has been through the full forensic pipeline. Where we could not name it, we say so.
Dune's own dex.trades resolver reports $7.13B of raw tracked volume for this
window, and every figure on this page is computed on all of it. That is a change from the
previous version of this note, which excluded two contracts the resolver itself named
FakeHook — $1,786.5M carried in a single transaction apiece, a pricing artifact
rather than real trading. Those rows fall outside the 7 days to August 24, 2026, so there is
no exclusion left to make and no ex-outlier basis to state: we report $7.13B as tracked volume,
and raw tracked volume is the same number. The exclusion is the reason the previous window
published $3.34B rather than $5.12B, so read the week-over-week jump in the denominator as
part real growth and part the artifact aging out.
It is tracked volume, not the chain's total. Our $7.13B is 88.6% of DefiLlama's $8.05B for Base over the same window — we are now under it, where the previous window's raw figure ran at 140% of DefiLlama and the window before that at 111%. Both directions are the same warning: these are different measurements of the same chain, taken from different source data, and the gap between them moves by more in a week than any figure on this page. We went looking for a double-count when the ratio ran high and did not find one; every transaction is collapsed to a single notional before any volume is summed, and the excess was already present in the raw per-leg source data before our pipeline touched it. What we have not done is re-localize the gap now that it has crossed to the other side. So read every percentage here against our tracked set, not against Base as a whole.
More than half of it is bots. 55.1% of the denominator is MEV and arbitrage flow, which has no frontend by construction. So the 90.71% we attribute should not be read as 90.71% being apps. Most of what we resolve is bots, desks, and routers behaving exactly as expected. The unattributed slice is the part nobody can place at all.
The five contracts below were the top of this page's open list when we named them, in the week to August 17, 2026; the volumes shown are their volume in the current window. None of them is a company name, because none of them resolves to one: the evidence supports an operator and an architecture, not an identity. That is the standard we hold ourselves to, and it is why these read as descriptions rather than brands.
Now: Anonymous Vault Router (Safe 0xe296…5658). This is the contract the first version of this note led with, the one deployed at the same address on four chains that every entity database came back empty on. The reason every proxy lookup failed is that it stores its implementation in a custom storage slot rather than the EIP-1967 slot, so standard tooling reads nothing there. Reading that slot directly exposes a ~20KB implementation whose revert strings ("Bot address not whitelisted", "Not proxy owner and not whitelisted") match an already-labeled sibling cluster, and the governing Gnosis Safe is a hardcoded immutable in the runtime. Its callers are the cluster's own whitelisted bot fleet, not public users. Held unnamed by three prior runs; the thing that broke it was checking a non-standard slot.
Now: Anonymous Execution Proxy (operator 0xb045…7adb). Not identifiable
on its own, and it had been skipped by an earlier pass as too thin to judge. It became legible
as a fleet: 22 contracts on Base sharing one identical 680-byte runtime, all deployed
by the same automated EOA, and all returning that same EOA from owner(). A
per-user smart-wallet product would set the owner to each user; one owner across 22 contracts
is one operator. This member carries 74% of the fleet's volume. We first wrote this up as
private automated trading and had to correct ourselves hours later: it is running the
Aerodrome liquidity strategy described below, which we only saw once we started reading
position NFTs.
Now: MEV/Arbitrage Bot. Briefly the largest unattributed contract on Base
once the two above were named. Its code is unverified, but it keeps its revert strings, and
they settle the question: MIN_PROFIT, POOL_FLASH_FAILED,
NO_CALLBACK_ADAPTER, TAIL_NOT_AFTER_LOOP. A profit floor enforced in
the contract, a flash-loan callback and a cyclic route is the standard arbitrage design. The
traffic agrees: across 300 sampled transactions there is exactly one function selector, 75% of
the calls revert, and 16 distinct unnamed EOAs drive it. No frontend reverts three quarters of
its users' swaps for failing to clear a profit threshold.
Now: Anonymous Aerodrome LP Manager (operator 0x6c22…f64f). Nothing in
its own bytecode names it: it is a 352-byte proxy over an unverified implementation whose only
readable strings are about transferring gas. What names it is what it holds. Every
NFT it receives is minted by one contract, and that contract's metadata reads "Slipstream
Position NFT v1", symbol AERO-CL-POS: an Aerodrome concentrated-liquidity
position. AERO arrives 233 times and leaves 5, which is what harvested emissions look like.
It holds none of those positions, because all 200 we sampled were minted and burned inside a
single transaction.
Now: Anonymous Aerodrome LP Manager (factory 0x6694…a8a0). The same
business, run the opposite way: it holds 184 Slipstream positions rather than cycling them.
Its revert strings are all namespaced LST: and are pure position mechanics
(LST: invalid quoter, LST: rebalance failed, LST: Token
already exists for this pool+tick). It is deployed by a factory rather than by a
person, which is what a product looks like rather than a private fleet. We cannot tell you
what LST stands for, and we are not going to guess.
The residue is still genuinely a long tail, and it got longer. $663M is spread across 6,732 contracts, only 82 of which moved more than $1M; the largest is 12.9% of the pool and the top ten together are 41%. The median open contract moved about $5,200. The pool has more than four times the addresses it held a week ago, and the largest single contract in it went from 7.0% to 12.9%, so it lengthened and concentrated at the same time. Two of them we have examined closely and still cannot name, and they are now the two largest.
What we know: unverified contract, ~9.1KB of bytecode. Executes
Seaport-style fulfillBasicOrder settlement calls alongside its DEX activity. Holds
an inventory of airdropped spam tokens, which pollutes behavioral fingerprinting. No deployer
attribution. Volume is real routed DEX flow, not transfer noise.
What we know: unverified, ~21.9KB of bytecode, so a substantial program rather than a minimal proxy. No deployer attribution, no named counterparties in its flow, and the same airdropped-spam-token pollution. Behavior is consistent with an owned routing or inventory contract; whose, we cannot say.
All figures are tracked DEX volume over the 7 days ending August 24, 2026, with attribution labels as of August 24, 2026. Attribution volume refreshes on the Monday sync, so the volume window and the label date are stated separately. Updated 2026-08-24. The prior version of this note covered the week to August 17, 2026, where the unattributed slice read $205M of $3.34B ex-outlier. The dollars roughly tripled and the percentage moved from 6.2% to 9.29%; those two moves are not the same size because the prior window's denominator excluded $1,786.5M of single-transaction artifact and this one excludes nothing.
Growth-number integrity. When a chain, a grants program, or an incentive campaign reports DEX volume, the unattributable slice is the part no reviewer can classify as organic or bot. On Base that slice is $663M a week. You cannot say what incentives bought until you can say who sent the volume.
Unknown winners. Not every unknown is a bot, though of the five we named here, four were infrastructure and one was outright arbitrage. Some of the volume we have resolved on Base traced back to real products, including a major exchange's aggregator router that carried tens of millions before it was labeled. A contract quietly moving eight figures a week might be extraction, or it might be infrastructure for an app succeeding on your chain that no ecosystem team has on its radar. Either answer is worth having.
If you can tie any of these contracts to a frontend, app, desk, or bot operator, or you know someone who can, I want to hear from you: andrew@cleartracedata.com. Verified labels go into the open attribution dataset with credit if you want it, and the coverage number above moves for everyone who uses the data.
We hold ourselves to a verification standard: a label ships only when the evidence survives the same forensic checks that failed to name these contracts in the first place. That standard is also why the five we named here are named for their architecture and their operator address rather than for a company we cannot prove is behind them.
Data: ClearTrace attribution engine, tracked Base DEX volume, 7-day window ending August 24, 2026, labels as of August 24, 2026. Attribution volume refreshes on the Monday sync, so the volume window and the label date are deliberately stated separately. Coverage percentages are volume-weighted and use our corrected classifier, which counts explicit non-identifications as unattributed. Contract observations are from public on-chain records; "unverified" means no source code is published on the chain explorer. Written by Andrew Maury, founder of ClearTrace. ClearTrace is a neutral measurement service: no venue, chain, or aggregator pays for placement in our data.