{"id":77463,"date":"2026-08-30T06:08:30","date_gmt":"2026-08-30T06:08:30","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/ethereums-top-sandwich-bot-made-295m-then-lost-7-5m\/"},"modified":"2026-08-30T06:08:30","modified_gmt":"2026-08-30T06:08:30","slug":"ethereums-top-sandwich-bot-made-295m-then-lost-7-5m","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/ethereums-top-sandwich-bot-made-295m-then-lost-7-5m\/","title":{"rendered":"Ethereum&#8217;s Top Sandwich Bot Made $295M, Then Lost $7.5M"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">JaredfromSubway.eth\u2019s bot has extracted over 117,000 ETH (~$295M) from trades since March 2023.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">An attacker drained the sandwich bot of $7.5M in June 2026 using 66 fake token contracts.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Three relays route 88% of MEV-Boost blocks, and Titan alone builds more than half of them.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>The Hunter Becomes the Hunted<\/h2>\n<p>Earlier this year in June, an unidentified attacker <a href=\"https:\/\/www.chainalysis.com\/blog\/sandwich-attack-jaredfromsubway-hack\/\" target=\"_blank\" rel=\"noopener noreferrer\">deployed 66 fake token contracts on Ethereum<\/a>, dressing them up as familiar names like WETH, USDC, and USDT. The target wasn\u2019t a retail wallet; it was Jaredfromsubway.eth, the single most prolific sandwich-attack operator on the network.<\/p>\n<p><\/p>\n<p>Over the following hours, the bot\u2019s own automated trading logic did what it always does, i.e., scan for arbitrage opportunities in the fake tokens and, in doing so, grant token-spending approvals to the attacker\u2019s malicious contracts. Once enough approvals had accumulated, the attacker swept the bot\u2019s real holdings in a coordinated sequence of transactions, draining at least $7.5 million in ETH and stablecoins before <a href=\"https:\/\/news.bitcoin.com\/us-government-bans-ethereum-mixer-tornado-cash-platform-added-to-ofacs-sdn-list\/\">laundering the proceeds through Tornado Cash<\/a>.<\/p>\n<p>None of these funds have been recovered to date.<\/p>\n<p>The irony isn\u2019t lost on the Ethereum research community as a bot built to exploit other traders\u2019 blind spots got taken down by the exact mechanism that makes its own business model possible.<\/p>\n<p>But the exploit also undersold just how large that business had become. Trackers following every ETH transfer into the bot\u2019s primary contract show a cumulative haul of 117,007 ETH as of Aug. 28, accumulated steadily since the contract\u2019s first recorded extraction in March 2023.<\/p>\n<h2>What MEV Actually Is<\/h2>\n<p>Maximal Extractable Value (MEV) is the profit a block producer (or anyone who can influence which transactions land in a block and in what order) can capture by inserting, reordering, or excluding transactions. It exists because Ethereum\u2019s mempool, where pending transactions wait to be included, is publicly visible before it\u2019s final. Anyone watching that mempool can see a large pending trade and act on the information before it settles.<\/p>\n<p>A sandwich attack is MEV\u2019s most consumer-hostile form. When a trader submits a swap large enough to move a token\u2019s price on a decentralized exchange, a bot detects it in the mempool, submits its own buy order immediately before the victim\u2019s transaction (paying a higher gas fee to guarantee it lands first), lets the victim\u2019s trade execute at the now-worse price, then immediately sells into the price the victim\u2019s own trade pushed up.<\/p>\n<p>The victim\u2019s slippage tolerance (i.e., the maximum price movement they\u2019ll accept) becomes the bot\u2019s profit margin. No hack, no exploit, no smart contract bug; it\u2019s a pure function of transaction ordering, executed thousands of times a day.<\/p>\n<p>MEV isn\u2019t new because researchers were describing miners reordering transactions for profit as early as 2019, and the term itself was <a href=\"https:\/\/arxiv.org\/abs\/1904.05234\" target=\"_blank\" rel=\"noopener noreferrer\">coined in a 2019 academic paper<\/a> on \u201cminer extractable value.\u201d What changed the game was Flashbots, a research organization founded in 2020 that built the first private auction system for MEV, aiming to pull the practice out of the public mempool and into an orderly bidding process.<\/p>\n<p>Ethereum\u2019s community nicknamed the pre-Flashbots mempool the \u201cdark forest,\u201d a place where any visible transaction carrying value could be ambushed within seconds. MEV-Boost, launched alongside Ethereum\u2019s 2022 <a href=\"https:\/\/news.bitcoin.com\/what-is-the-merge-a-brief-explanation-of-ethereums-transition-from-proof-of-work-to-proof-of-stake\/\">transition to proof-of-stake<\/a>, generalized that private-auction model into the default way blocks get built today.<\/p>\n<h2>The Machinery Behind Every Block<\/h2>\n<p>Sandwich bots don\u2019t get to choose block order on their own; they compete for it through MEV-Boost, the out-of-protocol auction system that more than 90% of Ethereum validators use to outsource block construction. In MEV-Boost, specialized \u201cbuilders\u201d assemble full blocks and submit bids to \u201crelays,\u201d which validate the blocks and forward the highest bid to the validator scheduled to propose next. The validator picks blind, seeing only the bid amount, not the block\u2019s contents, then signs whichever block pays the most.<\/p>\n<p>That auction has consolidated into a small number of hands. A live snapshot from relayscan.io, the Flashbots-run MEV-Boost monitor, shows relay.ultrasound.money handling 34.0% of payloads over a 24-hour window, Titan Relay 28.5%, and bloXroute\u2019s regulated relay 25.0% (meaning <a href=\"https:\/\/www.relayscan.io\" target=\"_blank\" rel=\"noopener noreferrer\">three relays route roughly 85% \u2013 88%<\/a> of all MEV-Boost blocks between them).<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-843171\" src=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/08\/mev-explained-ethereums-top-sandwich-bot-made-295m-then-lost-7-5m3_nwmk.jpg\" alt=\"MEV builder share\" width=\"833\" height=\"606\" srcset=\"https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/08\/mev-explained-ethereums-top-sandwich-bot-made-295m-then-lost-7-5m3_nwmk-300x218.jpg 300w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/08\/mev-explained-ethereums-top-sandwich-bot-made-295m-then-lost-7-5m3_nwmk-768x559.jpg 768w, https:\/\/static.news.bitcoin.com\/wp-content\/uploads\/2026\/08\/mev-explained-ethereums-top-sandwich-bot-made-295m-then-lost-7-5m3_nwmk.jpg 833w\" sizes=\"auto, (max-width: 833px) 100vw, 833px\"\/><\/p>\n<p>Builder concentration is starker with Titan\u2019s own builder operation assembling 50.3% of blocks outright, with Quasar and Buildernet each around 16%. A single company effectively decides transaction ordering for half of Ethereum\u2019s blocks in any given window, the centralization risk that critics of MEV-Boost have warned about since its 2022 rollout.<\/p>\n<p>In other words, a dominant builder can selectively include, exclude, or reorder transactions with little competitive check.<\/p>\n<h2>Sandwiches Are Shrinking But Not Fast Enough<\/h2>\n<p>Despite the eye-popping lifetime numbers around bots like JaredfromSubway, there is a silver lining, as the sandwich-attack economy collectively has been quietly deflating. Data drawn from a <a href=\"https:\/\/www.tradingview.com\/news\/cointelegraph:fa12ba092094b:0-exclusive-data-from-eigenphi-reveals-that-sandwich-attacks-on-ethereum-have-waned\/\" target=\"_blank\" rel=\"noopener noreferrer\">dataset of more than 95,000 attacks<\/a> shows monthly sandwich extraction falling from roughly $10 million in late 2024 to about $2.5 million in October 2025, a 75% decline in under a year.<\/p>\n<p>Traders adopting <a href=\"https:\/\/news.bitcoin.com\/hackless-offers-sandwich-attack-protection-for-bsc-and-ethereum-networks\/\">MEV-protection tools<\/a> (be it private RPCs or order-flow auctions that keep pending trades out of the public mempool, which sandwich bots scan) get most of the credit for squeezing that margin.<\/p>\n<p>That said, analysts <a href=\"https:\/\/news.bitcoin.com\/crypto-crime-hits-154b-in-2025-but-its-below-1-of-onchain-activity\/\">still put trader losses to sandwich attacks<\/a> at roughly $60 million a year at the strategy\u2019s peak, a number block builders indirectly benefit from too, since a large share of MEV profit ultimately flows to them as the priority fees bots pay to guarantee their transactions land in the right order.<\/p>\n<h2>Ethereum\u2019s Roadmap Has a Structural Answer<\/h2>\n<p>From the outside looking in, the enshrined proposer-builder separation (ePBS) module, which is part of the planned <a href=\"https:\/\/news.bitcoin.com\/ethereum-glamsterdam-upgrade-final-testing\/\">Glamsterdam upgrade<\/a>, will move today\u2019s off-protocol MEV-Boost auction into the network\u2019s consensus rules, removing relays as trusted middlemen and giving validators cryptographic guarantees about block content without needing to trust a builder or relay operator.<\/p>\n<p>However, until that upgrade ships and makes its way onto the market, the honest summary of Ethereum\u2019s MEV landscape is still one of looming uncertainty.<\/p>\n<\/p><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/learning-insights\/mev-sandwich-attacks-explained\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways JaredfromSubway.eth\u2019s bot has extracted over 117,000 ETH (~$295M) from trades since March 2023. An attacker drained the sandwich bot of $7.5M in June 2026 using 66 fake token contracts. Three relays route 88% of MEV-Boost blocks, and Titan alone builds more than half of them. The [&hellip;]<\/p>\n","protected":false},"author":3947362404,"featured_media":77464,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/77463"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/3947362404"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=77463"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/77463\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/77464"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=77463"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=77463"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=77463"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}