#MyGateTradeStory

Most Famous MEV Bot on Ethereum Loses US$7,5 Million in an On-Chain Honeypot Trap
An attacker drained approximately US$7,5 million from JaredFromSubway MEV bot—one of the most active sandwich-attack systems on Ethereum—after successfully tricking the bot into approving the use of tokens that it should not have been authorized to use.
Security company Blockaid, which uncovered this incident, said the bot was not affected by a smart-contract bug, phishing attack, or a private-key leak. Instead, the attacker exploited the profit-seeking logic of the bot itself to carry out the attack.
How This MEV Bot Was Tricked
The JaredFromSubway MEV bot runs an automated strategy that scans the Ethereum mempool to find profitable trading opportunities. This practice is known as maximal extractable value.
The bot front-runs and back-runs other transactions to capture price differences, using a tactic called a sandwich attack.
The bot rose to fame in April 2023. In a single day, it burned more than US$1 million in gas fees—equivalent to nearly 8% of all Ethereum gas expenditure at the time.
The attacker spent weeks deploying 66 fake token contracts. The fake tokens mimicked Wrapped Ether (WETH), USD Coin
USDCUSD
, and Tether
USDTUSD
.
To the bot, these contracts looked like the trading routes it was searching for. The bot fell for the bait and granted token usage approval to helper contracts controlled by the attacker. Just one approval transferred more than 92 WETH to them.
Then, the final contract used this open permission to sweep the bot’s actual funds.
Reverse-MEV Trap
This trap turns the bot’s speed and aggressiveness into its own weakness. Going after MEV bots is nothing new. In 2023, a malicious validator drained around US$25 million from a sandwich MEV bot.
“the attacker-controlled contract successfully tricked the automated MEV execution system into granting token permissions, which were then used to drain the funds,” Blockaid explained.
These kinds of sandwich attacks have long faced criticism because they are seen as an invisible tax on everyday traders.
The bot operators estimate the losses are even approaching US$15 million. They also offered a US$1 million reward if the funds are returned. Meanwhile, Blockaid and PeckShield estimate that the amount drained on the network totals around US$7,5 million in the form of WETH, USDC, and USDT.
Whether the operator can recover the funds now will depend on whether the attacker is willing to accept the offer.