Incident Overview
Published 6/22/2026, 9:10:45 PM
On June 20, 2026, the prominent Ethereum MEV bot jaredfromsubway.eth was drained of approximately $7.5 million in a sophisticated "counter-MEV honeypot" attack. The exploit did not rely on a traditional code bug or private key compromise; instead, it weaponized the bot's own automated profit-seeking logic and the persistence of ERC-20 token approvals.
Incident Overview
The attack targeted the bot's tendency to grant high token allowances to contracts it interacted with during sandwich attacks and arbitrage trades.
| Metric | Details |
|---|---|
| Date of Incident | June 20, 2026 (approx. 6:49 PM UTC) |
| Total Estimated Loss | ~$7.5 million (Operator claims up to $15M) |
| Assets Stolen | 1,474.58 WETH, 2.87M USDC, 2M USDT |
| Primary Vulnerability | ERC-20 Approval Accumulation |
| Attacker Action | Swapped for ~4,400 ETH; 1,000 ETH sent to Tornado Cash |
How the Honeypot Was Executed
The exploit was a multi-week operation designed to trick the bot's pattern-recognition system into granting permanent spending permissions to malicious contracts.
- The Setup: The attacker deployed 66 counterfeit token contracts and fake liquidity pools. These contracts mimicked legitimate assets but contained hidden "backdoor" withdrawal functions [Source: https://example.com/search1].
- The Lure: The attacker initiated small, legitimate-looking trades. The bot's logic identified these as profitable opportunities. To execute these trades, the bot followed standard DeFi procedure: it approved the attacker's contracts to spend its tokens [Source: https://example.com/search1].
- The Trap: In subsequent transactions, the attacker structured trades so the bot would grant high token allowances, but the attacker's contract would not actually consume them. The automated bot continued to accumulate these "open" permissions across dozens of fake contracts without revoking them [Source: https://example.com/search1].
- The Drain: A single Coordinator Contract triggered withdrawal functions across all 66 fake contracts simultaneously. Using the
transferFromfunction, the attacker swept the bot's real WETH, USDC, and USDT into their own wallets [Source: https://example.com/search1].
Technical Root Cause
The exploit targeted automated trust in simulated returns. While traditional audits check for code correctness, they often do not account for how a bot's decision-making logic reacts to adversarially constructed inputs over long periods. The bot failed to verify if allowances were being left open unnecessarily, a behavior security firms noted as a fundamental logic flaw in high-frequency MEV operations [Source: https://example.com/search1].
Impact and Aftermath
Prior to the attack, jaredfromsubway.eth was a dominant force on Ethereum, responsible for an estimated 70% of all sandwich attacks between late 2024 and late 2025 [Source: https://example.com/search2].
Following the drain, the attacker began laundering the assets, with at least 1,000 ETH deposited into the Tornado Cash mixer [Source: https://example.com/search3]. While the bot operator reportedly offered a $1 million bounty for the return of funds, the exploit transaction (0x2be8704f5a59b69e0b71f64aefdb99eb0e8ae9fb3926147c581910d71bcf3e65) effectively crippled the bot's immediate liquidity [Source: https://example.com/search1]. Specific data on the bot's long-term operational recovery or current market share post-incident remains undocumented in available research.
Next Steps:
- To assess the current state of the bot's wallet, I can perform an on-chain analysis of its recent transaction history and remaining balances.
- If you are interested in the broader MEV landscape, I can research current top-performing bots and their vulnerability to similar counter-MEV strategies.