Impact on Fund Tracking
Published 6/21/2026, 11:42:37 AM
The deposit of 1,000 ETH (approximately $1.74 million) to Tornado Cash significantly complicates the tracking of the "JaredFromSubway" MEV bot exploit by severing the direct on-chain link between the stolen funds and their eventual destination. While the deposit creates a major hurdle for investigators, it does not make tracking impossible, as forensic firms utilize probabilistic methods to re-establish links based on withdrawal patterns.
Impact on Fund Tracking
The use of Tornado Cash introduces several technical and behavioral layers that obscure the audit trail:
- Broken Transaction History: Tornado Cash utilizes zk-SNARKs to allow users to withdraw funds to a fresh address without any on-chain connection to the original deposit address [Source: https://blockeden.xyz/forum/t/ethereums-best-year-for-privacy-meets-the-drift-exploit-tornado-cash-problem-can-blockchain-privacy-exist-without-enabling-money-laundering/4639].
- Anonymity Set: By depositing 1,000 ETH into the protocol's standard 100 ETH pools, the attacker mixes their assets with all other participants in those pools. This makes it mathematically difficult to prove which specific withdrawal belongs to the attacker without additional metadata.
- Probabilistic Re-linking: Investigators like TRM Labs and BlockAid monitor for "behavioral clues." If the attacker withdraws the 1,000 ETH in a specific pattern (e.g., ten 100-ETH withdrawals in rapid succession) or moves them to a centralized exchange with KYC requirements, the link can be re-established [Note: not independently confirmed].
Exploit Summary: JaredFromSubway Bot
The exploit, which occurred on June 21, 2026, targeted the automated MEV detection system of the well-known "JaredFromSubway" sandwich bot [Source: https://www.coindesk.com/tech/2026/06/21/ethereum-s-biggest-sandwich-bot-drained-of-usd7-5-million-in-ironic-exploit].
| Metric | Value | Source |
|---|---|---|
| Total Estimated Drain | ~$7.5 Million | [Source: https://cointelegraph.com/news/notorious-sandwich-attack-bot-jaredfromsubwayeth-exploited-for-75m] |
| Tornado Cash Deposit | 1,000 ETH | [Source: https://www.kucoin.com/news/flash/jaredfromsubway-attacker-transfers-1000-eth-to-tornado-cash] |
| Total ETH Swapped | ~4,400 ETH | [Source: http://www.odaily.news/en/newsflash/492672] |
| Obfuscation Rate | ~22.7% of converted ETH | [Source: http://www.odaily.news/en/newsflash/492672] |
Current Status of Funds
The attacker successfully moved roughly 22.7% of the converted ETH into Tornado Cash [Verified: http://www.odaily.news/en/newsflash/492672]. The remaining funds (approximately 3,400 ETH) were initially held in identifiable attacker-controlled wallets, though some reports suggest a portion may have been bridged to external addresses like bc1pv8yc5q [Contested: not independently confirmed].
The exploit was executed by baiting the bot with fake tokens (such as fWETH and fUSDC) and fake liquidity pools. This tricked the bot into granting token approvals to attacker-controlled contracts, which were then used to drain WETH, USDC, and USDT [Verified: https://www.coindesk.com/tech/2026/06/21/ethereum-s-biggest-sandwich-bot-drained-of-usd7-5-million-in-ironic-exploit].
Conclusion: The 1,000 ETH deposit successfully "cleans" a significant portion of the loot, but the attacker remains vulnerable to tracking if they fail to maintain strict operational security during the withdrawal phase.
Next Steps
- Monitor Withdrawals: Would you like me to set up a recurring scan to check for 100 ETH withdrawals from Tornado Cash that might correlate with this attacker's activity?
- Technical Deep Dive: I can perform a technical analysis of the "fake token" contracts used in the exploit to identify if similar vulnerabilities exist in other MEV bot configurations.