MEV Boost Exploit Hack

TOTAL LOST $26.1M
High #192 All-Time Other

Summarize with AI

ChatGPT Perplexity Claude Grok
Affected Chain 2023 Incident surface
Recovered - No recovery reported
All-Time Rank #192 By amount stolen
Protocol Type Exploit/Other Target category

Incident Overview

Quick Summary

MEV-Boost Relay was exploited by the validator and resulted in a loss of 26,123,300 $USD.

Details of the Exploit

MEV-Boost Relay is a software for PoS Ethereum used to implement Proposal/Builder separation. A malicious validator exploited a vulnerability in the MEV-Boost Relay and drained five MEV bots.

Attack Vector

starts from the exploiter to trigger MEV bots to buy already prepared tokens from UniV2 pools. Consequently, the validator executed transactions, front-running the bots. When the MEV bot tries to take profit, the attacker sets both the parent root and state root to zero of the block, making it impossible for the block to be accepted by the network after being signed correctly by proposers. As a result, they could take revealed transactions from deconstructed bundles and claim liquidity from unlucky MEV bots included in that block. Approximately, 26,123,300 $USD worth of $WETH, $WBTC, $USDT, and $DAI were siphoned out from the affected contracts.

The patch was rolled out shortly after this incident where now mev-boost-relay will refuse to return transactions if blocks are not successfully sent into networks. In addition, there is now an added delay of one second before responding with any transaction data.

Further investigation led to evidence suggesting malicious actors three EOA addresses funded just 25 days ago were used as part of planning and preparing various token pools. Three out of five affected bots had their entire balances drained due to automated strategies working against them when bought tokens without regard for price impact.

Block Data Reference

Attacker address:

https://etherscan.io/address/0xf489bd7b…ce746e

Malicious block:

https://etherscan.io/txs?block=16964664

Contract holding funds:

https://etherscan.io/address/0x3c98d617…D1D8Eb

https://etherscan.io/address/0x5B04db6D…3905b6

https://etherscan.io/address/0x27bf8f09…9C8f69

Draining transaction example:

https://etherscan.io/tx/0xa34d79cb…319c85

Incident Report

Protocol / Project MEV Boost Exploit
Date of Incident
Attack Technique Other
Classification Other
Primary Source View Post-Mortem #1 View Post-Mortem #2 View Post-Mortem #3

Protocol Information

Protocol Type Exploit/Other
Official Website boost.flashbots.net/
Team Anonymous
Source Code Verified On-Chain

What the Attacker Needed to Succeed

Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.

Technical Knowledge Deep understanding of other and Solidity and EVM internals
Capital Required Seed capital to cover gas and initial position setup
On-Chain Access Ability to interact with smart contracts and deploy a custom exploit contract
Protocol Analysis Identification of the exploitable vulnerability in MEV Boost Exploit's contract logic - root cause: other
Execution Speed Precise transaction ordering and timing to exploit the vulnerability within a single atomic block
Obfuscation Plan A strategy to launder and move stolen funds - typically through mixers, cross-chain bridges, or decentralized DEX swaps to resist tracing

What Auditors Should Check

Could this have been caught in audit? Likely — with a thorough Other audit checklist and test coverage

If you're auditing a protocol with similar architecture to MEV Boost Exploit, these are the critical security checks that could have prevented this incident (April 2023).

  • Verify all logic paths related to Other are guarded by proper access controls and input validation
  • Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs

Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.

Free Trial

Sources & References

Browse all hacks

These hacks used the same attack technique. Understanding the pattern helps prevent future exploits.

DeFiTuna $570K
Other
Cascade $1.3M
Other
Lumi Finance $264K
Other
Hinkal $820K
Other
AIDCToken $121K
Other
Polymarket $3.0M
Other

Learn to Prevent the Next MEV Boost Exploit

The MEV Boost Exploit hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.

Start Free Trial Browse Attack Library
Recreate exploit patterns safely Free Trial