Ethereum’s Top Sandwich Bot Made $295M, Then Lost $7.5M

MEV Explained: <a href="https://xpertsstudio.com/charles-schwab-backs-ethereum-solana-xrp-and-hyperliquid/” title=”Charles Schwab Backs Ethereum, Solana, XRP and Hyperliquid”>Ethereum‘s Top Sandwich Bot Made $295M, Then Lost $7.5M

A single Ethereum contract has pulled in more than 117,000 ETH, roughly $295 million at current prices, sandwiching other traders since March 2023, and in June, an anonymous attacker turned its own playbook against it for a $7.5 million payday.

WRITTEN BYShiraz Jagati
SHARE
Published:Aug 30, 2026, 1:30 AM EDT

Key Takeaways

• JaredfromSubway.eth’s bot has extracted over 117,000 ETH (~$295M) from trades since March 2023.
• An attacker drained the sandwich bot of $7.5M in June 2026 using 66 fake token contracts.
• Three relays route 88% of MEV-Boost blocks, and Titan alone builds more than half of them.

The Hunter Becomes the Hunted

Earlier this year in June, an unidentified attacker deployed 66 fake token contracts on Ethereum, dressing them up as familiar names like WETH, USDC, and USDT. The target wasn’t a retail wallet; it was Jaredfromsubway.eth, the single most prolific sandwich-attack operator on the network.

Over the following hours, the bot’s own automated trading logic did what it always does, i.e., scan for arbitrage opportunities in the fake tokens and, in doing so, grant token-spending approvals to the attacker’s malicious contracts. Once enough approvals had accumulated, the attacker swept the bot’s real holdings in a coordinated sequence of transactions, draining at least $7.5 million in ETH and stablecoins before laundering the proceeds through Tornado Cash.

None of these funds have been recovered to date.

The irony isn’t lost on the Ethereum research community as a bot built to exploit other traders’ blind spots got taken down by the exact mechanism that makes its own business model possible.

But the exploit also undersold just how large that business had become. Trackers following every ETH transfer into the bot’s primary contract show a cumulative haul of 117,007 ETH as of Aug. 28, accumulated steadily since the contract’s first recorded extraction in March 2023.

What MEV Actually Is

Maximal Extractable Value (MEV) is the profit a block producer (or anyone who can influence which transactions land in a block and in what order) can capture by inserting, reordering, or excluding transactions. It exists because Ethereum’s mempool, where pending transactions wait to be included, is publicly visible before it’s final. Anyone watching that mempool can see a large pending trade and act on the information before it settles.

A sandwich attack is MEV’s most consumer-hostile form. When a trader submits a swap large enough to move a token’s price on a decentralized exchange, a bot detects it in the mempool, submits its own buy order immediately before the victim’s transaction (paying a higher gas fee to guarantee it lands first), lets the victim’s trade execute at the now-worse price, then immediately sells into the price the victim’s own trade pushed up.

The victim’s slippage tolerance (i.e., the maximum price movement they’ll accept) becomes the bot’s profit margin. No hack, no exploit, no smart contract bug; it’s a pure function of transaction ordering, executed thousands of times a day.

MEV isn’t new because researchers were describing miners reordering transactions for profit as early as 2019, and the term itself was coined in a 2019 academic paper on “miner extractable value.” What changed the game was Flashbots, a research organization founded in 2020 that built the first private auction system for MEV, aiming to pull the practice out of the public mempool and into an orderly bidding process.

Ethereum’s community nicknamed the pre-Flashbots mempool the “dark forest,” a place where any visible transaction carrying value could be ambushed within seconds. MEV-Boost, launched alongside Ethereum’s 2022 transition to proof-of-stake, generalized that private-auction model into the default way blocks get built today.

The Machinery Behind Every Block

Sandwich bots don’t get to choose block order on their own; they compete for it through MEV-Boost, the out-of-protocol auction system that more than 90% of Ethereum validators use to outsource block construction. In MEV-Boost, specialized “builders” assemble full blocks and submit bids to “relays,” which validate the blocks and forward the highest bid to the validator scheduled to propose next. The validator picks blind, seeing only the bid amount, not the block’s contents, then signs whichever block pays the most.

That auction has consolidated into a small number of hands. A live snapshot from relayscan.io, the Flashbots-run MEV-Boost monitor, shows relay.ultrasound.money handling 34.0% of payloads over a 24-hour window, Titan Relay 28.5%, and bloXroute’s regulated relay 25.0% (meaning three relays route roughly 85% – 88% of all MEV-Boost blocks between them).

Builder concentration is starker with Titan’s own builder operation assembling 50.3% of blocks outright, with Quasar and Buildernet each around 16%. A single company effectively decides transaction ordering for half of Ethereum’s blocks in any given window, the centralization risk that critics of MEV-Boost have warned about since its 2022 rollout.

In other words, a dominant builder can selectively include, exclude, or reorder transactions with little competitive check.

Sandwiches Are Shrinking But Not Fast Enough

Despite the eye-popping lifetime numbers around bots like JaredfromSubway, there is a silver lining, as the sandwich-attack economy collectively has been quietly deflating. Data drawn from a dataset of more than 95,000 attacks shows monthly sandwich extraction falling from roughly $10 million in late 2024 to about $2.5 million in October 2025, a 75% decline in under a year.

Traders adopting MEV-protection tools (be it private RPCs or order-flow auctions that keep pending trades out of the public mempool, which sandwich bots scan) get most of the credit for squeezing that margin.

That said, analysts still put trader losses to sandwich attacks at roughly $60 million a year at the strategy’s peak, a number block builders indirectly benefit from too, since a large share of MEV profit ultimately flows to them as the priority fees bots pay to guarantee their transactions land in the right order.

Ethereum’s Roadmap Has a Structural Answer

From the outside looking in, the enshrined proposer-builder separation (ePBS) module, which is part of the planned Glamsterdam upgrade, will move today’s off-protocol MEV-Boost auction into the network’s consensus rules, removing relays as trusted middlemen and giving validators cryptographic guarantees about block content without needing to trust a builder or relay operator.

However, until that upgrade ships and makes its way onto the market, the honest summary of Ethereum’s MEV landscape is still one of looming uncertainty.

Where Stolen Crypto Really Goes: Inside the 45-Day Laundering Machine

Hackers stole $3.4 billion in crypto in 2025 and topped $1 billion again in the first half of 2026. Once…

Tags in this story

Ethereum (ETH)Proof of Stake (PoS)Proof-of-Work (PoW)

Source: <a href="https://news.bitcoin.com/learning-insights/mev-sandwich-attacks-explained/” target=”_blank” rel=”nofollow noopener”>news.bitcoin.com