.png){kind=logo}
Jaredfromsubway.eth, one of Ethereum’s most active maximal extractable value bots, lost more than $7.5 million after attackers targeted its automated trading system. The attackers used fake tokens, liquidity pools, and contracts to present profitable-looking trades.
Blockchain security firm Blockaid said the bot approved attacker-controlled contracts after its system identified the false setups as MEV opportunities. The attackers later used those approvals to remove ETH, USDC, and USDT from addresses linked to the bot.
Blockaid described the incident as a “counter-MEV honeypot attack,” although the full technical sequence is still under review. The firm said the scheme did not follow the usual pattern of a phishing campaign or a direct flaw in the bot’s main smart contract.
Instead, the attackers designed contracts that interacted with the bot’s decision-making process. The automated system treated the activity as a valid trading chance and granted token permissions to helper contracts controlled by the attackers.
The attackers reportedly deployed 66 fake token contracts over several weeks. Those contracts copied the names and interfaces of assets such as Wrapped ETH, USDC, and USDT. They also created false liquidity pools linked to CAP tokens.
These pools produced signals that matched the conditions the bot searched for on Ethereum. Blockaid chief technology officer Raz Niv said the setup caused the bot to approve spending access. He stated that the process “provided the attacker the keys to millions,” though investigators have not published every contract step.
The attackers later called the approved contracts in one transaction and transferred the assets. Onchain records place the total loss above $7.5 million. Blockchain data also shows that part of the stolen funds moved through Tornado Cash.
Jaredfromsubway.eth became known for sandwich attacks on decentralized exchanges. In this form of MEV trading, a bot places one trade before a user’s swap and another after it. The sequence can move the price and leave the user with a worse execution rate.
Research covering November 2024 to October 2025 linked the bot to about 70% of Ethereum sandwich attacks. Ethereum recorded an estimated 60,000 to 90,000 such transactions each month in that period. Separate estimates placed annual trader losses from sandwich activity near $60 million.
In May, the bot targeted a small DigitalBits swap linked to Ethereum co-founder Vitalik Buterin. The direct loss was limited, but the transaction showed that automated systems can act on trades with very small expected returns.
Ethereum MEV extraction had passed $1.2 billion by May, while sandwich attacks accounted for about 51% of the tracked volume. MEV bots monitor pending transactions and use order book dynamics, fees, and liquidity changes to seek profit before trades are included in a block.
The Jaredfromsubway.eth exploit shows how attackers can also study those automated rules. In this case, they built a false market environment that prompted the bot to authorize contracts without human review.
Ethereum developers have discussed encrypted mempools as one possible way to reduce harmful transaction ordering. Such systems aim to hide pending trade details until validators commit to an order, which could limit the information available to sandwich attackers. Development work and testing are still ongoing.
Also Read: Ethereum Price Today: ETH Slips as Glamsterdam Threatens Value Capture
