Jaredfromsubway.eth Bot Lost $7.5M to Attackers Using Its Own Logic
What You Need to Know
- Jaredfromsubway.eth sandwich bot lost $7.5 million after attackers exploited its own trading logic.
- Attackers created 66 fake tokens and pools designed to trigger the bot’s MEV indicators.
- Bot granted token approvals to attacker-controlled contracts, enabling the theft of funds.
- Sandwich attacks account for roughly half of Ethereum’s $1.2 billion annual MEV extraction.
Jaredfromsubway.eth, the Ethereum sandwich bot responsible for roughly 70% of all sandwich attacks on the network over the past year, lost $7.5 million after attackers engineered a trap using its own trading logic against it. The irony is structural: a bot built to exploit others got outplayed by someone who understood its decision-making better than its operators anticipated.
According to blockchain security firm Blockaid, the attackers constructed an entirely fabricated ecosystem of 66 fake tokens and pools, including convincing mimics of WETH, USDC, and USDT, paired with CAP tokens. The fakes were calibrated to trigger the exact MEV indicators the bot was programmed to identify as profitable, causing it to grant token approvals to attacker-controlled contracts. Blockaid CTO Raz Niv noted that this was not a conventional smart contract vulnerability but a manipulation of the bot’s trading logic itself. The distinction matters: traditional audits would not have caught this, because the contracts may have been technically sound. Some of the stolen funds have already moved to Tornado Cash, which complicates recovery prospects considerably.
The bot that sandwiched Vitalik Buterin’s own transaction in May, routing over a million dollars in WETH to squeeze profit from a swap involving a few thousand dollars of DigitalBits, has now had the same ruthless logic turned on itself.
The broader context is harder to ignore. MEV extraction on Ethereum has crossed $1.2 billion, with sandwich attacks accounting for roughly half of that volume. Ethereum traders collectively lose around $60 million per year to sandwich activity, and Jaredfromsubway.eth has been the dominant actor in that extraction. This incident will likely accelerate interest in encrypted mempool proposals, which Vitalik Buterin has been actively pushing as part of Ethereum’s roadmap precisely to neutralize harmful MEV. A high-profile drain of the network’s most aggressive sandwich operator gives that conversation renewed urgency among protocol developers who previously had to argue the problem in the abstract.
Buterin’s encrypted mempool advocacy now has a concrete, headline-ready case study attached to it. Whether that translates into faster implementation depends on Ethereum’s notoriously deliberate upgrade process, but the political conditions for prioritizing mempool privacy just got meaningfully better.
0 Comments