JaredFromSubway MEV bot loses $15M in counter-MEV honeypot exploit

The JaredFromSubway Ethereum MEV bot lost as much as $15 million after attackers tricked its automated trading system into approving fake contracts.

"This was a counter-MEV honeypot attack targeting the automated decision-making logic that MEV bots use," Raz Niv, chief technology officer at blockchain security firm Blockaid, said.

The attacker deployed 66 fake token contracts mimicking Wrapped ETH, USDC and USDT over several weeks, creating false liquidity pools that appeared profitable to the bot's scanning system. Once the bot granted ERC-20 approvals to attacker-controlled helper contracts, the threat actor swept ETH, USDC and USDT from the bot's treasury in a single transaction. Part of the stolen funds later moved through Tornado Cash, on-chain data shows.

The exploit highlights how MEV infrastructure — systems designed to profit from transaction ordering — can become attack surfaces when automated approval logic interacts with hostile contracts. JaredFromSubway, linked to roughly 70 percent of Ethereum sandwich attacks between November 2024 and October 2025, initially offered a $3 million bounty for the stolen funds, later raising it to $7.5 million for a 50 percent return.

The bot operator is also negotiating with a white-hat hacking group, though no deal has been confirmed. Sandwich attacks on Ethereum have caused an estimated $60 million in annual trader losses, with total MEV extraction on the network surpassing $1.2 billion by May. The incident adds pressure on MEV operators to review how automated systems handle token verification and liquidity-pool validation.

This article is for informational purposes only and does not constitute investment advice.