Jaredfromsubway.eth, a prominent Ethereum MEV bot, lost more than $7.5 million after approving attacker-controlled contracts that enabled an allowance drain. The incident occurred through a series of fake trading routes set up over several weeks. Security firm Blockaid identified the exploit as targeting the bot's automated approval logic rather than private keys or protocol flaws.
The bot, active since 2023 and responsible for roughly 70 percent of Ethereum sandwich attacks, approved transactions that appeared profitable. These approvals allowed the attacker to later transfer wrapped Ether, USDC, and USDT from associated contracts.
On-chain records show transfers of about 92 WETH, $143,000 in USDC, and $149,000 in USDT to an attacker-controlled address. Some funds were routed through Tornado Cash. Yearn Finance developer Banteg described the operation as an allowance drain executed via a coordinating contract.
The attack exploited ERC-20 permissions that remained active after initial test transactions. Blockaid noted that the setup involved imitation tokens and liquidity pools mimicking real markets.
Sandwich attacks linked to the bot have imposed an estimated $60 million in annual costs on Ethereum traders. The bot accounted for 7 percent of total gas usage on the network in a recent 24-hour period.
