Wu Shuo learned that security company Blockaid stated that the well-known Ethereum MEV bot JaredFromSubway was attacked, resulting in approximately $7.5 million in assets stolen.
The attacker constructed fake token wrappers and liquidity pools to trick its automated MEV execution system into granting token approvals to a contract controlled by the attacker.
Subsequently, the attacker exploited the unrevoked approvals to transfer out assets such as WETH, USDC, and USDT held by the bot via transferFrom.
Blockaid stated that this incident was not a traditional phishing attack, nor was it due to a smart contract vulnerability in the victim contract itself, but rather a flaw in the bot's mechanism that automatically identifies arbitrage opportunities and generates approvals.
The attacker constructed fake token wrappers and liquidity pools to trick its automated MEV execution system into granting token approvals to a contract controlled by the attacker.
Subsequently, the attacker exploited the unrevoked approvals to transfer out assets such as WETH, USDC, and USDT held by the bot via transferFrom.
Blockaid stated that this incident was not a traditional phishing attack, nor was it due to a smart contract vulnerability in the victim contract itself, but rather a flaw in the bot's mechanism that automatically identifies arbitrage opportunities and generates approvals.