On June 21, 2026, Jaredfromsubway.eth, a highly prominent Maximal Extractable Value (MEV) bot on the Ethereum network, was subjected to an exploit that resulted in a loss of $7.5M. This incident occurs in a context where the bot had been identified as responsible for 70% of sandwich attacks executed on Ethereum during the period spanning November 2024 to October 2025.
Technical Context of Sandwich Attacks and MEV
Sandwich attacks represent a specific form of MEV, a concept describing the value a validator or miner can extract from block production by manipulating the order, inclusion, or exclusion of transactions. In a sandwich attack, an attacker detects a victim's pending transaction on a decentralized exchange (DEX) which, if executed, will generate a significant price movement. The attacker then places a buy transaction before the victim's transaction (front-running) and a sell transaction immediately after (back-running). This sequence forces the victim's transaction to execute at an unfavorable price, while the attacker capitalizes on the price difference generated by their own manipulation.
Ethereum, due to its high activity in decentralized finance (DeFi) and the volume of transactions on DEXs, has historically been fertile ground for MEV operations. Network latency, mempool transparency, and validators' ability to order transactions facilitate these types of strategies.
Dominance and Profile of Jaredfromsubway.eth
The attribution of 70% of sandwich attacks to Jaredfromsubway.eth over a one-year period underscores the scale and operational sophistication of this bot. Such a level of dominance suggests advanced technical infrastructure, efficient transaction detection algorithms, and a considerable capacity to interact with the Ethereum mempool and validators. The profitability associated with this activity would have been substantial, solidifying Jaredfromsubway.eth as a significant player in the MEV landscape.
The $7.5M Exploit
The bot's exploitation for $7.5M represents a significant disruption to its operations. While the specific technical details of the exploited vulnerability have not been disclosed, such incidents can stem from various sources: vulnerabilities in the bot's smart contract code, flaws in its strategy logic,
