Skip to main content
AVOID.NET

JaredFromSubway.eth MEV Bot - Counter-Honeypot Exploit

avoid.net/jaredfromsubway-eth-mev-bot-counter-honeypot-exploit→10/100·88% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·sCC1n6…8u1t

Summary

JaredFromSubway.eth is a pseudonymously operated Ethereum MEV (Maximal Extractable Value) sandwich-attack bot that rose to infamy in 2023 and became responsible for an estimated 70% of all sandwich attacks on the Ethereum network between November 2024 and October 2025. On June 20, 2026, an unknown attacker reversed the bot's predatory logic against it, deploying 66 fake token contracts and fake liquidity pools to manipulate the bot into granting persistent token spending approvals, then sweeping approximately $7.5 million in WETH, USDC, and USDT in a single coordinated drain transaction. The stolen funds were subsequently routed through Tornado Cash, and the bot's operator — who offered a 50% white-hat bounty — has alleged they will pursue legal and law-enforcement remedies.

Connected Entities

6 entities · 60 linked investigations
Organizations
□Ethena55□JaredFromSubway.eth MEV Bot - Counter-Honeypot Exploit□Ethereum64□Vitalik Buterin25
Protocols
Relationships
  • Ethena→mentioned with→Ethereum(75%)
  • SushiSwap→mentioned with→Ethereum(60%)
  • SushiSwap→mentioned with→Uniswap(70%)
  • Uniswap→mentioned with→Ethereum(80%)
  • Uniswap→mentioned with→SushiSwap(60%)
  • Ethereum→mentioned with→Vitalik Buterin(80%)
  • JaredFromSubway.eth MEV Bot - Counter-Honeypot Exploit→mentioned with→Vitalik Buterin(80%)
  • Uniswap→mentioned with→Vitalik Buterin(80%)
  • Vitalik Buterin→mentioned with→Ethereum(65%)
  • JaredFromSubway.eth MEV Bot - Counter-Honeypot Exploit→mentioned with→Uniswap(65%)
  • + 3 more
Have evidence about JaredFromSubway.eth MEV Bot - Counter-Honeypot Exploit?

Timeline(9 events)

21 February 2023

JaredFromSubway.eth MEV bot first deployed on Ethereum mainnet.

CryptoMEVBot analysis

18 April 2023

Bot generates over $2 million in profit from 24,000+ sandwich attacks in two days during the PEPE memecoin trading frenzy, using $100 million in daily PEPE volume.

DL News

June 2023

Bot reported to appear in over 60% of all Ethereum blocks at peak operational intensity, executing millions of transactions.

The Block

3 April 2024

Bot records one of its best single trading days, generating approximately $300,000 in profits by targeting Ethena (ENA) token traders on the day of ENA's airdrop launch, with $14.8 million in ENA volume processed.

DL News

14 August 2024

Operator allegedly deploys a new contract address ('Jared 2.0'), deprecating the original. The new address, created by the same key pair, begins executing more sophisticated multi-layer sandwich attacks.

The Block

30 April 2026

Bot sandwich-attacks Ethereum co-founder Vitalik Buterin's swap of 26,544 XDB tokens for ETH, deploying $1.14 million in WETH to manipulate prices across SushiSwap and Uniswap V2. The bot fails to profit after gas fees.

CoinDesk

20 June 2026

Unknown attacker executes counter-honeypot exploit across approximately 97 blocks using 66 fake token contracts and fabricated liquidity pools, draining approximately $7.5 million (1,475 WETH, $2.9M USDC, $2M USDT) from the bot in a single coordinated drain transaction.

CoinDesk / Blockaid / Protos

22 June 2026

Bot operator posts on-chain message offering a 50% white-hat bounty (approximately 2,150 ETH, roughly $3.7 million) for return of stolen funds within 48 hours, threatening legal and law-enforcement action otherwise.

Decrypt

24 June 2026

Attacker ignores bounty deadline and routes approximately $5.1 million of stolen funds through Tornado Cash in 20 uniform 100-ETH transactions. Remaining approximately 1,422 ETH is converted to DAI stablecoin.

AMBCrypto / The Currency Analytics
Provenance & Audit Trail

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 18 of 18 cited source URLs have an Internet Archive snapshot.

model: claude-sonnet-4-6

generated: 7/1/2026, 12:05:16 PM

last updated: 7/27/2026, 2:17:31 PM

3 views

avoid.net — verified advice for a post-truth world