Famous Ethereum MEV bot JaredFromSubway hacked for $7.5 million

The well-known Ethereum MEV bot JaredFromSubway has fallen victim to an attack in which attackers managed to steal over $7.5 million. Security firm Blockaid detected the attack and reports that it involves a clever exploitation of the bot’s automatic approval mechanism, and not a phishing attack or a vulnerability in a smart contract.

Ethereum is available at OKX and Bybit.

How the attack works

The attackers deployed specially prepared contracts to trick the automated execution system of the MEV bot. These contracts lure the system into granting token approvals. Once those approvals are obtained, the attackers use the remaining limits to drain the bot.

Blockaid explains that the bot searches for MEV opportunities on the Ethereum network and automatically grants approvals in the process. It is precisely this mechanism that is exploited in the attack. The affected tokens are WETH, USDC and USDT, together accounting for a loss of approximately $7.5 million.

Consequences for the Ethereum community

JaredFromSubway is one of the best-known MEV bots on the Ethereum network and is known for its aggressive sandwich attacks on other users. It is therefore striking that this very bot has now fallen prey to a similar form of clever manipulation. The Ethereum news environment has already experienced more setbacks recently, as earlier the Ethereum Foundation also lost a prominent top figure, as can be read in this article about the departure of the co-director.

The Ethereum price stands at $1.726,66 at the time of writing, an increase of 0.3% in the past 24 hours. Meanwhile, analysts still see opportunities for Ethereum in the longer term, although the price has been moving erratically in recent weeks, as is also evident from previous analyses of the price around $1.720.