Attack on MEV Giant: Jaredfromsubway.eth Bot Lost Over $7.5 Million
The well-known MEV bot Jaredfromsubway.eth, which long dominated the field of sandwich attacks on Ethereum, fell victim to a sophisticated hacker attack. Losses amounted to over $7.5 million in digital assets. This event exposed vulnerabilities not in smart contracts per se, but in the automated decision-making mechanisms on which such bots are built.
How the Attack Was Carried Out
Experts from Blockaid, a company specializing in exploit detection, determined that the attacker operated through smart contracts under their control. They deployed dozens of fake token contracts disguised as popular liquid assets—WETH, USDC, and USDT. These contracts were linked to counterfeit liquidity pools that visually mimicked profitable trading opportunities.
MEV bots typically react to such "profitable" trades, seeking to execute a sandwich attack. As a result, the bot's automated execution system was deceived and issued approvals to the attacker's auxiliary contracts, allowing the spending of real assets. After that, the attacker activated all the embedded backdoors in a single transaction and withdrew the funds. Part of the stolen coins has already been sent to the Tornado Cash mixer.
Scale and Consequences
It is worth noting that Jaredfromsubway.eth was not just one of many MEV bots. According to my data, from November 2024 to October 2025, between 60,000 and 90,000 sandwich attacks were recorded monthly on the Ethereum network, and about 70% of them were linked specifically to this bot. Its annual "contribution" to trader losses from such manipulations was estimated at approximately $60 million. In June 2024, this bot even became the largest consumer of gas on the Ethereum network, highlighting its scale and aggressiveness.
My professional opinion: This attack is not just another hack. It is a demonstration that even the most sophisticated automated systems, designed to extract profit from others' transactions, can be turned against their creators. The incident calls into question the reliability of the entire MEV ecosystem, which relies on trust in simulations and signed approvals. In the near future, we will likely see stricter security requirements for such bots and a revision of the architecture of their interaction with liquidity.