JaredFromSubway.eth MEV Bot hack — June 2026

On 20 June 2026 the Ethereum MEV bot operating under the ENS name jaredfromsubway.eth, for years the most active sandwich-trading bot on the network, was drained in a single sweep transaction. Security firm Blockaid, which published the technical analysis, dates it to 18:49:11 UTC in block 25360696 and recorded 1,474.58 WETH, 2,870,573 USDC and 2,035,760 USDT leaving the bot's contracts, worth roughly $7.5 million.

The attack exploited neither a bug in the bot's own contracts nor a stolen private key. The attacker deployed 66 identical impostor token contracts from a single factory, each mimicking the name and interface of WETH, USDC or USDT and each paired with a sham liquidity pool. The fake routes read as profitable arbitrage to the bot's automated decision logic, which executed them and, as the trades required, granted progressively larger ERC-20 spending approvals to attacker-controlled helper contracts. Approvals accumulated across 42 transactions and 423 approval events, reaching about 92.16 WETH per contract. Each impostor token carried an owner-only withdraw function callable only by the attacker, which executed a transferFrom up to the standing approval amount; a single final transaction invoked all 66 at once.

Figures differ. Blockaid put the loss at roughly $7.5 million. On-chain tracker Lookonchain, cited by The Block, counted about 4,427 ETH, roughly $7.7 million, converted by the attacker, with 1,000 ETH deposited into Tornado Cash. A $15 million figure, repeated by BleepingComputer, originated with an X account that claimed to be the operator and offered a bounty; The Block reported that onchain commentators flagged that account as a likely impersonator and that it could not verify any link between the account and the bot. No funds have been recovered.