#MyGateTradeStory

The Most Famous MEV Bot on Ethereum Loses $7.5 Million in On-Chain Honeypot Trap

An attacker drained approximately $7.5 million from JaredFromSubway MEV bot, one of the most active sandwich attack systems on Ethereum, after successfully tricking the bot into approving the use of tokens that should not have been authorized.

Security firm Blockaid, which discovered this incident, stated that the bot was not affected by a smart contract bug, phishing attack, or private key leak. Instead, the attacker exploited the bot's own profit-seeking logic to carry out the attack.

How This MEV Bot Was Tricked

JaredFromSubway MEV bot runs an automated strategy that scans the Ethereum mempool for profitable trading opportunities. This practice is known as maximal extractable value.

The bot front-runs and back-runs other transactions to profit from price differences, using a tactic called a sandwich attack.

This bot became famous in April 2023. In one day, it spent over $1 million on gas fees, nearly 8% of all Ethereum gas expenditure at that time.

The attacker spent weeks deploying 66 fake token contracts. These fake tokens mimicked Wrapped Ether (WETH), USD Coin (USDC), and Tether (USDT).

For the bot, these contracts appeared to be trading routes it was actively seeking. The bot was fooled and approved the use of tokens to helper contracts controlled by the attacker. A single approval transferred more than 92 WETH to them.

Then, the final contract used this open permission to drain the original funds from the bot.

Reverse-MEV Trap

This trap turned the bot’s speed and aggressiveness into its own weakness. Hunting MEV bots is not a new tactic. In 2023, a malicious validator drained around $25 million from a sandwich MEV bot.

“The attacker-controlled contract successfully deceived the automated MEV execution system into granting token permissions, which were then used to drain the funds,” explained Blockaid.

Such sandwich attacks have long faced criticism for being an invisible tax on everyday traders.

The bot operators estimate losses approaching $15 million. They also offered a $1 million reward if the funds are returned. Meanwhile, Blockaid and PeckShield estimate the drained amount on the network to be around $7.5 million in WETH, USDC, and USDT.

The likelihood of the operator recovering the funds now depends on whether the attacker is willing to accept the offer.