• A well-known MEV bot, JaredFromSubway, was hacked on Ethereum.
• Yes, it fell victim to its own strategy because of fake tokens.
• Losses were estimated in the range of $7.5 million-$15 million.

The analytics firm Blockaid reported a successful attack on one of the best-known MEV bots in the Ethereum ecosystem — jaredfromsubway.eth. The incident occurred in June 2026 and led to losses ranging from $7.5 million to more than $15 million depending on the counting methodology. 

The event drew the attention of the crypto community because it was not a classic phishing attack or a smart-contract vulnerability, but a manipulation of the logic of the automated trading algorithm itself.

According to Blockaid, the attacker managed to deceive the system that searches for profitable MEV opportunities, forcing the bot to grant approvals to spend assets to third-party contracts on its own.

"This is not a classic phishing attack and not a traditional vulnerability of the victim's smart contract," Blockaid emphasized.

How the scheme worked

According to the researchers, the attacker created dozens of fake tokens and liquidity pools that imitated popular assets such as WETH, USDC and USDT. Tokens such as fWETH, fUSDC and fUSDT were used for this, which looked like potentially profitable arbitrage routes.

The JaredFromSubway algorithm identified these operations as profitable and automatically granted the attacker's contracts the rights to spend funds. During the first test transactions, the approvals were used immediately, so no suspicious activity arose.

Later the attacker changed the mechanics. The bot continued to grant approvals, but this time they were neither used nor revoked. As a result, the attacker accumulated active approvals to spend funds.

Blockaid cited one example in which the bot approved spending more than 92 WETH to the address of the attacker's helper contract. These approvals were subsequently used for the final withdrawal of assets via the transferFrom function.

The company noted that funds in WETH, USDC and USDT were transferred to the attacker's wallet after he used the previously obtained approvals.

"The predator became the prey"

The incident provoked a lively reaction in the crypto community because of JaredFromSubway's reputation. For a long time the bot was one of the largest executors of so-called sandwich attacks on the Ethereum network.

Commentator Kyle Chassé stated:

"Since 2023, Jaredfromsubway.eth has earned millions off traders. It was the most famous bot for 'sandwich attacks' on Ethereum. About 70% of all 'sandwich attacks' on the network came from this wallet. This weekend a hunt was opened on the bot itself. […]The predator became the prey."

In turn, GlydeGG co-founder Jeremy Chung noted:

"Ethereum's most famous MEV bot, JaredFromSubway, just lost more than $15 million. After years of earning on 'sandwich attacks,' someone finally took revenge."

An analyst under the pseudonym zubic_eth added that the bot effectively "approved its own robbery," since its automated logic worked exactly as it had been programmed.

The MEV problem remains relevant

The story of JaredFromSubway became yet another example of the risks associated with MEV infrastructure. Earlier, Flashbots stated that MEV bots have become a systemic problem for blockchain scaling, since they can consume more than half of the available gas on networks.

A similar incident also occurred in 2025 with Coinbase. Because of erroneous corporate-wallet settings, the exchange lost about $300,000 after granting dangerous approvals while interacting with a contract of the 0x protocol. The company then revoked the approvals and changed its wallet configuration.

JaredFromSubway itself had previously made headlines repeatedly because of extremely high fee expenses. In November 2024 the bot paid more than $118,000 for a single transaction on Ethereum, and in June of the same year it spent about $820,000 on gas in just one day.

Source: Incrypted