Fund Movement Timeline
Published 6/21/2026, 1:34:17 PM
The hacker who exploited the jaredfromsubway.eth MEV bot moved funds with high velocity, transferring approximately $1.72 million (1,000 ETH) into Tornado Cash within 24 hours of the initial exploit [Source: https://cointelegraph.com/news/jaredfromsubway-mev-bot-hacked-7-5-million]. The laundering process began on June 21, 2026, immediately following the consolidation of stolen assets on June 20 [Source: https://peckshield.com/alert/jaredfromsubway-exploit-timeline].
Fund Movement Timeline
The transition from the exploit to the mixer was highly structured, occurring in three distinct phases over a two-day window.
| Phase | Date | Action |
|---|---|---|
| Exploit | June 20, 2026 | Drained ~$7.5M from bot via allowance exploit [Source: https://www.theblock.co/post/301124/jaredfromsubway-eth-mev-bot-exploited-for-7-5-million]. |
| Consolidation | June 20, 2026 | Swapped stolen WETH, USDC, and USDT into ~4,427 ETH. |
| Laundering | June 21, 2026 | Initiated deposits of 1,000 ETH into Tornado Cash [Source: https://cointelegraph.com/news/jaredfromsubway-mev-bot-hacked-7-5-million]. |
Deposit Patterns and Strategy
The hacker's strategy focused on maximizing obfuscation through standardized transaction sizes and rapid asset conversion:
- Standardized Sizing: The attacker utilized 100 ETH increments for deposits [Source: https://arkhamintelligence.com/exploit-analysis/jaredfromsubway-june-2026]. This is a common tactic to blend into Tornado Cash's largest anonymity set, making it more difficult for analysts to link deposits to specific withdrawals.
- Asset Consolidation: Before moving to the mixer, the hacker consolidated fragmented assets—including 1,474 WETH, 2.87M USDC, and 2M USDT—into a single pool of ETH [Source: https://blockaid.io/blog/jaredfromsubway-honeypot-analysis].
- Laundering Ratio: Within the first 24 hours, the hacker moved approximately 22.7% of the total consolidated ETH (1,000 out of ~4,400 ETH) into the protocol [Source: https://cointelegraph.com/news/jaredfromsubway-mev-bot-hacked-7-5-million].
Exploit Context
The speed of the fund movement was preceded by a patient, multi-week setup. The attacker deployed 66 fake token contracts to bait the MEV bot into granting approvals [Source: https://blockaid.io/blog/jaredfromsubway-honeypot-analysis]. Once the bot interacted with these "honeypot" tokens, the attacker exploited the unspent approvals to drain the wallet's primary holdings.
In summary, the hacker moved nearly a quarter of the stolen funds into Tornado Cash within one day of the exploit, using standardized 100 ETH deposits to mask their trail. The status of the remaining ~3,400 ETH remained unconfirmed as of the latest reports on June 21, 2026.