Ethereum's Largest Sandwich Bot Is Drained of About $7.5 Million by Its Own Logic

One of Ethereum's most active extraction bots became the victim. Jaredfromsubway.eth, the address responsible for a large share of "sandwich" attacks on the network (trades placed immediately before and after a victim's trade to profit from the resulting price move), was drained of roughly $7.5 million on June 20, according to security firm Blockaid in reporting by CoinDesk. Some on-chain analysts put the loss above $15 million, and the discrepancy reflects how the funds were spread across several tokens.

The attack was carried out gradually and was carefully targeted. Blockaid's chief technology officer, Raz Niv, described it as a "counter-MEV honeypot attack." Maximal extractable value (MEV) is the profit a bot can capture by reordering or inserting transactions around a victim's trade. Over several weeks the attacker deployed 66 counterfeit token contracts built to imitate Wrapped Ether (WETH), USD Coin (USDC) and Tether (USDT), each paired with fake liquidity pools designed to look like profitable trades.

The bot's automated code performed exactly as designed. It interacted with the counterfeit pools and, in doing so, granted spending approvals to helper contracts the attacker controlled. The attacker then called all 66 of those approvals in a single transaction and took the bot's real WETH, USDC and USDT. The cause was not a broken cryptographic function but a flaw in the bot's logic. It had granted approvals to contracts it never verified.

No funds have been recovered and the operator behind the address has not been identified. Researchers have long estimated that sandwich attacks cost ordinary Ethereum traders tens of millions of dollars a year, with Jaredfromsubway.eth tied to a majority of them in past periods. The loss does not change that calculation for traders, but it does establish that even the most aggressive extraction code can itself be attacked.