jaredfromsubway.eth exploit analysis

jaredfromsubway.eth, one of Ethereum's most active MEV bots and the operator behind a large share of "sandwich" trades on the network, was drained of about $7.5 million on June 20, 2026. The bot's operator is pseudonymous and has not made a verified public statement. The Block reported the technical detail; CryptoSlate laid out the allowance-trap mechanism.

How the trap worked

On-chain security firm Blockaid said the attacker did not compromise a private key or exploit a flaw in a widely used DeFi protocol. Instead, the attacker spent several weeks deploying imitation tokens, liquidity pools, and supporting contracts that resembled markets the bot would normally trade against. The bot's automated execution system approved transactions that looked like profitable trading routes; those approvals remained active on attacker-controlled contracts that could later be used to remove tokens.

The single sweep

Onchain data showed the drain ran at 18:49 UTC and moved 1,474.58 WETH, around 2.87 million USDC and roughly 2 million USDT to an attacker address in a single transaction. Some of the proceeds were laundered through Tornado Cash. A later X account claiming to be the bot's operator asserted a larger loss and offered a bounty, but evidence suggests the account is an impersonator. The Block pinned the on-chain total at about $7.5 million.

Where it sits in the corpus

Approval traps have appeared in other 2026 incidents, including wallet-level phishing drains of retail users, but the jaredfromsubway case is the largest in which the target was a sophisticated automated system. The bot's edge was reading opportunities faster than a human could, and that same edge is what closed the loop on the attacker: the bot granted approvals in milliseconds in pursuit of routes that humans would have rejected. The corpus has more retail-side drainer cases than sophisticated-target cases like this one.