MEV Boost Exploit Hack
What happened
In the last minutes of 2 April 2023 (UTC), a malicious Ethereum validator used a flaw in Flashbots' mev-boost-relay software, run by the ultra sound relay, to drain several sandwich MEV bots. Flashbots put the loss at about $20M, and US prosecutors later put it at about $25M. The relay revealed the contents of a block to the proposer even though the header the proposer signed was invalid.
The proposer then reordered the bots' own transactions against them in a block they built themselves. Relays were patched to reveal block contents only after the relay had published the block. In May 2024 US prosecutors charged brothers Anton and James Peraire-Bueno with wire fraud conspiracy, money laundering and receiving stolen property.
Their October 2025 trial ended in a mistrial when the jury could not reach a verdict, and prosecutors sought a retrial in early 2026.
How it happened
- The attacker controlled a validator scheduled to propose a block, and sent bait transactions designed to attract sandwich bots. The bots submitted bundles that the relay packed into a valuable block.
- At 23:29 UTC on 2 April 2023, for slot 6137846, the proposer asked the ultra sound relay for the block header, then returned a signed header that was invalid, with a zeroed state root and parent root.
- The relay's
getPayloadhandler checked the proposer's signature but not whether the signed header was valid. It returned the full block body, and the invalid block could not be published. - With the bots' transactions exposed, the proposer built its own block for the slot. It replaced the bait with transactions that drained the bots' liquidity, taking about $20M-$25M in assets.
Protocol details
Evidence
- report @samczsun incident report twitter.com
- report @PeckShieldAlert incident report twitter.com
- report @punk3155 incident report twitter.com
- analysis DeFiLlama defillama.com
- analysis Post mortem: April 3rd, 2023 mev-boost relay incident and related timing issue collective.flashbots.net
- analysis MEV Bot Incident Analysis certik.com
- analysis MEV bot exploit heads to US court, testing crypto's legal gray zones cointelegraph.com
- analysis Prosecutors request February or March retrial for MEV bot brothers cointelegraph.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
