#MyGateTradeStory

Most Famous MEV Bot on Ethereum Loses $7.5 Million in On-Chain Honeypot Trap
An attacker drains approximately $7.5 million from JaredFromSubway MEV bot, one of the most active sandwich-attack systems on Ethereum, after successfully tricking the bot into approving the use of tokens it should not have authorized.
Security firm Blockaid, which discovered this incident, stated that the bot was not affected by a smart contract bug, phishing attack, or private key leak. Instead, the attacker exploited the bot's own profit-seeking logic to carry out the attack.
How This MEV Bot Was Tricked
JaredFromSubway MEV bot runs an automated strategy that scans the Ethereum mempool for profitable trading opportunities. This practice is known as maximal extractable value.
The bot front-runs and back-runs other transactions to profit from price differences, using a tactic called sandwich attack.
This bot became famous in April 2023. In one day, it spent over $1 million on gas fees, nearly 8% of all Ethereum gas expenditure at that time.
The attacker spent weeks deploying 66 fake token contracts. These fake tokens mimicked Wrapped Ether (WETH), USD Coin (USDC), and Tether (USDT).
For the bot, these contracts appeared as trading routes it was actively seeking. The bot was baited and approved token usage for helper contracts controlled by the attacker. Just one approval transferred more than 92 WETH to them.
Then, the final contract used this open permission to drain the actual funds from the bot.
Reverse-MEV Trap
This trap turns the speed and aggressiveness of the bot into its own weakness. Hunting MEV bots is not new. In 2023, a malicious validator drained around $25 million from a sandwich MEV bot.
“The attacker-controlled contract successfully deceived the automated MEV execution system into granting token permissions, which were then used to drain the funds,” explained Blockaid.
Sandwich attacks like this have long faced criticism for being an invisible tax on everyday traders.
Bot operators estimate losses approaching $15 million. They also offered a $1 million reward if the funds are returned. Meanwhile, Blockaid and PeckShield estimate the drained amount on the network to be around $7.5 million in WETH, USDC, and USDT.
Whether the operator can recover the funds now depends on whether the attacker is willing to accept the offer.