JaredFromSubway.eth MEV Bot Hack

Reported loss $7.5M
Ethereum
Other

What happened

On June 20, 2026, the jaredfromsubway.eth sandwich bot, one of the busiest MEV bots on Ethereum, was drained of about $7.5 million: 2,869,812 USDC, 2,032,770 USDT and 1,474 WETH, about 4,424 ETH in total. The attacker did not steal a key or phish anyone, and did not use an ordinary bug in a DeFi protocol. They set a trap in the bot's own trading logic. They deployed fake tokens that looked like wrapped WETH and USDC, created lopsided Uniswap V2-style pools that looked like profitable trades, and let the bot trade against them. Each trade left a token approval behind that the bot never used up or revoked. The attacker then used those approvals to pull the bot's real balances.

The attacker swapped the stablecoins to ETH, sent 3,000 ETH to Tornado Cash, swapped about 1,422 ETH to DAI, and spread the rest across several wallets. No recovery has been reported.

How it happened

  1. The attacker deployed bait tokens posing as restaked WETH and USDC wrappers, plus fake pools priced to look like arbitrage opportunities for the bot (CertiK counts 131 bait tokens).
  2. The bot traded the bait routes normally for about a day. Before each trade it approved the wrapper token to spend its WETH, USDC or USDT, and one early trade made the bot a tiny profit.
  3. During the attack, the attacker front-ran the bot's transactions with a markStatusAndTip() call that set a status flag to the current block. With that flag set, the fake wrapper's wrapTo() skipped its transferFrom(), so the bot's approval stayed open instead of being used.
  4. After repeating this across many routes, the attacker triggered 66 approval-bait contracts in one sweep. They called transferFrom on the leftover allowances and moved the bot's real USDC, USDT and WETH out.
  5. The stolen funds were swapped to ETH and moved through Tornado Cash and other wallets.

Protocol details

Classification Other / Market Manipulation
Protocol Type Exploit/Other
Implementation language Solidity

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes