Verify a decision

{"actor":"system:backfill","investigation_id":"4cab0096-1bed-44a7-a426-9d3d147f7d95","kind":"publish","page_slug":"jaredfromsubway-eth-mev-bot-counter-honeypot-exploit","published_at":"2026-07-01T12:05:26.198Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"JaredFromSubway.eth MEV Bot - Counter-Honeypot Exploit","sections":[{"content":"JaredFromSubway.eth is a pseudonymously operated Ethereum MEV bot that began operations on February 21, 2023. The entity is named in dark humor after a former fast-food chain spokesperson convicted of criminal offenses. Its operator has remained anonymous; in a 2023 interview a representative for the bot stated it had no public social media accounts. The bot specializes in sandwich attacks: it monitors Ethereum's public mempool for pending DEX trades, places a large buy order immediately before the victim's transaction to inflate the asset price, allows the victim's trade to execute at the inflated price, then sells its position for a profit. The victim receives a worse execution price while the bot captures the spread. According to research cited by Chainalysis, sandwich attacks on Ethereum cause approximately $60 million in annual losses for traders, with 60,000 to 90,000 such attacks occurring per month at peak periods, with roughly 70% attributed to JaredFromSubway.eth between November 2024 and October 2025.","heading":"Background: What Is JaredFromSubway.eth","severity":"high","sources":[{"credibility":1,"name":"Sandwich Attack: How JaredfromSubway Lost $7.5M - Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/sandwich-attack-jaredfromsubway-hack/"},{"credibility":2,"name":"Jaredfromsubway.eth's MEV bot rakes in millions of dollars in three months - The Block","type":"news_article","url":"https://www.theblock.co/post/230218/jaredfromsubway-mev-bot"},{"credibility":3,"name":"Investigation of the MEV Sandwich Bot jaredfromsubway.eth - CryptoMEVBot","type":"research","url":"https://cryptomevbot.com/blog/jaredfromsubway-mev-bot-analysis"}]},{"content":"The bot launched in February 2023 and rose to prominence during the April 2023 PEPE memecoin trading frenzy. During a seven-day peak period at the height of PEPE trading, the bot generated over $1.7 million in profit according to SeaLaunch analytics, with single days recording more than 24,000 sandwich attacks against PEPE traders. At its peak in mid-2023 the bot appeared in over 60% of all Ethereum blocks. In April 2024, the bot recorded one of its best single trading days by targeting Ethena (ENA) token traders on the day of ENA's airdrop launch, generating approximately $300,000 in a single session after processing $14.8 million in ENA volume according to Parsec Finance founder Will Sheehan. In August 2024, the operator allegedly deprecated the original contract address and deployed a new iteration, described as 'Jared 2.0' by MEV tracking site EigenPhi. The new address processed over 85,000 transactions, generating approximately 765 ETH. More advanced multi-layer attacks including five-layer and seven-layer sandwich constructions were documented in this period. On April 30, 2026, the bot sandwiched a token swap executed by Ethereum co-founder Vitalik Buterin — who was swapping 26,544 digitalbits (XDB) tokens valued at approximately $3.86 — by deploying $1.14 million in WETH across SushiSwap and Uniswap V2 to manipulate price. The bot failed to profit on that particular transaction after gas fees of $5.14, but the incident drew widespread media coverage as Buterin had publicly advocated for encrypted mempools as a fix for toxic MEV.","heading":"Scale of Sandwich Attack Operations (2023-2026)","severity":"high","sources":[{"credibility":2,"name":"DeFi's most notorious bot makes record 2024 profit targeting ENA traders - DL News","type":"news_article","url":"https://www.dlnews.com/articles/defi/mev-bot-jaredfromsubway-attacks-ethena-traders-on-ethereum/"},{"credibility":2,"name":"Jaredfromsubway.eth is back with a new MEV bot and new sandwich attacks - The Block","type":"news_article","url":"https://www.theblock.co/post/312245/jaredfromsubway-eth-is-back-with-a-new-mev-bot-and-new-sandwich-attacks"},{"credibility":1,"name":"Vitalik Buterin gets sandwiched by JaredfromSubway as Ethereum MEV risks linger - CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/05/07/jaredfromsubway-bot-front-runs-vitalik-buterin-s-usd4-token-swap-with-usd1-million-in-volume"},{"credibility":2,"name":"A trading bot is making sandwiches amid memecoin craze - The Block","type":"news_article","url":"https://www.theblock.co/post/227110/mev-trading-bot-memecoins-subway"}]},{"content":"On June 20, 2026, an unknown attacker drained approximately $7.5 million from the JaredFromSubway.eth bot in a sophisticated counter-MEV honeypot operation confirmed by on-chain security firm Blockaid. The attack inverted the bot's own predatory logic against it. According to forensic analysis published by pseudonymous Yearn developer banteg, the attacker deployed 66 fake token contracts mimicking legitimate assets including WETH, USDC, and USDT, paired with fabricated liquidity pools designed to appear as profitable DEX arbitrage opportunities. The attack unfolded across approximately 97 Ethereum blocks: the attacker seeded the fake pools with small but genuine arbitrage signals. The bot's automated systems identified these as MEV opportunities and executed sandwich transactions — a standard workflow — but during each execution the bot's contract approved attacker-controlled child contracts to spend real WETH, USDC, and USDT. Crucially, these approvals were neither consumed during the sandwiches nor revoked afterwards, creating persistent ERC-20 spending allowances across all 66 attacker-controlled contracts. Banteg characterized the attacker's architecture as a 'block-armed switch': the fake child contracts behaved like normal principal-consuming wrappers during small 'unarmed' test batches but acted as backdoors during larger 'armed' batches that left approvals open. Once the attacker had accumulated sufficient allowances — Banteg identified 16 live WETH allowances of approximately 92.16 WETH each — a single coordinated drain transaction called a withdrawal function across all 66 contracts simultaneously. Each contract pulled funds up to its open allowance via standard ERC-20 transferFrom() calls. The extracted assets comprised approximately 1,475 WETH ($2.6 million), $2.9 million USDC, and $2 million USDT, for a total of approximately $7.5 million. The attacker then converted the stolen assets to approximately 4,427 ETH valued at roughly $7.7 million at prevailing prices.","heading":"The Counter-Honeypot Exploit (June 20, 2026)","severity":"critical","sources":[{"credibility":1,"name":"Ethereum's biggest sandwich bot drained of $7.5 million in ironic exploit - CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/06/21/ethereum-s-biggest-sandwich-bot-drained-of-usd7-5-million-in-ironic-exploit"},{"credibility":2,"name":"MEV bot JaredFromSubway.eth loses $7.5M to approvals honeypot - Protos","type":"news_article","url":"https://protos.com/mev-bot-jaredfromsubway-eth-loses-7-5m-to-approvals-honeypot/"},{"credibility":2,"name":"JaredFromSubway MEV Bot Drained via Counter-MEV Honeypot and Fake Token Approvals - Mallory","type":"research","url":"https://www.mallory.ai/stories/019eefdf-6843-7a09-bed5-b17a2a3e5643"},{"credibility":2,"name":"Jaredfromsubway.eth MEV Bot Exploited for $7.5M - What Builders Need to Know - thirdweb","type":"research","url":"https://blog.thirdweb.com/jaredfromsubway-eth-mev-bot-exploited-for-7-5m-what-builders-need-to-know/"},{"credibility":2,"name":"Notorious jaredfromsubway MEV bot drained for roughly $7.5 million in counter-MEV honeypot - The Block","type":"news_article","url":"https://www.theblock.co/post/405464/notorious-jaredfromsubway-mev-bot-drained-for-roughly-7-5-million-in-counter-mev-honeypot"}]},{"content":"Following the June 20, 2026 drain, the stolen funds were rapidly laundered. According to AMBCrypto, the attacker broke 2,000 ETH into 20 uniform batches of 100 ETH each and deposited them into the Tornado Cash mixing protocol, complicating blockchain forensic tracing. The remaining approximately 1,422 ETH was converted to approximately $2.44 million in DAI stablecoin. In total, approximately $5.1 million of the $7.5 million stolen was confirmed as having passed through Tornado Cash as of June 24, 2026, per reporting by The Currency Analytics and AMBCrypto. On June 22, 2026, the operator of JaredFromSubway.eth posted an on-chain message offering a '50% white hat bounty' — approximately 2,150 ETH valued at roughly $3.7 million at the time — in exchange for the return of the remaining funds within a 48-hour deadline. The operator warned that failing to respond within the deadline would result in them pursuing 'all available legal and law-enforcement remedies.' The attacker ignored the bounty offer. On-chain investigator Specter noted the perpetrator showed no intention of restitution. The operator's legal threat was widely noted by commentators as ironic given the bot's history of extracting value from retail traders without recourse. A separate X account claiming $15 million in losses and offering a $1 million bounty was identified as an alleged impersonator of the real operator.","heading":"Aftermath: Tornado Cash Laundering and Bounty Rejection","severity":"critical","sources":[{"credibility":2,"name":"20 transactions, $5.1M transferred to Tornado Cash - AMBCrypto","type":"news_article","url":"https://ambcrypto.com/20-transactions-5-1m-transferred-to-tornado-cash-aftermath-of-the-jaredfromsubway-eth-attack/"},{"credibility":2,"name":"Jaredfromsubway Hacker Ignores 50% Bounty, Routes Funds to Tornado Cash - CryptoPotato","type":"news_article","url":"https://cryptopotato.com/jaredfromsubway-hacker-ignores-50-bounty-routes-funds-to-tornado-cash/"},{"credibility":2,"name":"Ethereum MEV Bot JaredFromSubway Threatens Legal Action After $7.5 Million Loss - Decrypt","type":"news_article","url":"https://decrypt.co/371787/ethereum-mev-bot-jaredfromsubway-legal-action-7-5-million-attack"},{"credibility":2,"name":"$5.1 Million Hits Tornado Cash in 20 Transactions After jaredfromsubway.eth Exploit - The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/altcoins/5-1-million-hits-tornado-cash-in-20-transactions-after-jaredfromsubway-eth-exploit-269602"}]},{"content":"The exploit exposed a structural weakness in MEV bot smart contract design: the failure to revoke ERC-20 token spending approvals after each transaction. In standard DeFi interactions, a token approval grants an external contract the right to transfer a specified quantity of tokens on the approving address's behalf via the ERC-20 transferFrom() function. JaredFromSubway.eth's architecture granted these approvals to helper contracts as part of its sandwich attack workflow but did not cancel unused allowances afterwards. This left cumulative, persistent spending rights open to attacker-controlled addresses. The banteg analysis highlighted the attacker's use of a dual-mode contract design: in 'unarmed' mode during early test phases the contracts behaved normally, consuming approvals during trades, which allowed the bot to record genuine small profits and continued executing against the fake pools. In 'armed' mode the contracts deliberately left approvals intact, gradually building a portfolio of open allowances across 66 addresses. The final drain required only a single coordinator transaction to call the withdrawal function across all contracts simultaneously, each pulling funds up to its allowance ceiling. Security researchers noted that well-architected bot systems should validate the legitimacy of counterparty contracts before execution, limit approvals to the exact amount required for each transaction, and implement post-transaction revocation of any unused allowances. The Blockaid security firm confirmed the attack mechanics. Thirdweb published a builder-oriented post-mortem recommending integration of security simulation tools before execution and rigorous approval hygiene in automated on-chain systems.","heading":"Technical Vulnerability Analysis","severity":"high","sources":[{"credibility":2,"name":"Jaredfromsubway.eth MEV Bot Exploited for $7.5M - What Builders Need to Know - thirdweb","type":"research","url":"https://blog.thirdweb.com/jaredfromsubway-eth-mev-bot-exploited-for-7-5m-what-builders-need-to-know/"},{"credibility":2,"name":"MEV bot JaredFromSubway.eth loses $7.5M to approvals honeypot - Protos","type":"news_article","url":"https://protos.com/mev-bot-jaredfromsubway-eth-loses-7-5m-to-approvals-honeypot/"},{"credibility":3,"name":"How a Fake MEV Opportunity Cost JaredFromSubway.eth $7.5M - DEV Community","type":"research","url":"https://dev.to/cryip/how-a-fake-mev-opportunity-cost-jaredfromsubwayeth-75m-52gn"}]},{"content":"The JaredFromSubway.eth incident prompted significant commentary about the ethics and risks of MEV extraction on Ethereum. The bot had extracted value from retail traders for over three years without those traders having meaningful recourse; the operator's subsequent appeal to law enforcement was widely characterized as ironic by industry observers. Cointelegraph Research has estimated sandwich attacks cost Ethereum traders approximately $60 million per year. Cumulative MEV extracted on Ethereum across all types exceeds $1.2 billion, with sandwich attacks representing roughly 51% of total MEV volume according to CoinDesk reporting citing mempool analytics. Ethereum co-founder Vitalik Buterin, who was himself sandwiched by the JaredFromSubway.eth bot on April 30, 2026, has publicly advocated for encrypted mempools as part of Ethereum's 2026 roadmap to reduce toxic MEV. The JaredFromSubway.eth counter-exploit did not involve any third-party victim losses beyond the bot operator's own treasury. However, commentators noted that the operator continued running sandwich attack operations against retail traders through at least June 2026, with the new bot contract active up to the time of the exploit. The operator's identity remains unknown as of the time of writing.","heading":"Broader Context: MEV, Retail Harm, and Irony of the Exploit","severity":"medium","sources":[{"credibility":1,"name":"Vitalik Buterin gets sandwiched by JaredfromSubway as Ethereum MEV risks linger - CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/05/07/jaredfromsubway-bot-front-runs-vitalik-buterin-s-usd4-token-swap-with-usd1-million-in-volume"},{"credibility":2,"name":"Sandwich bots filch millions off unwitting investors during meme coin rally - DL News","type":"news_article","url":"https://www.dlnews.com/articles/markets/memecoin-pepe-sandwich-bots-219m-mev/"},{"credibility":2,"name":"Ethereum MEV Bot JaredFromSubway Threatens Legal Action After $7.5 Million Loss - Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/ethereum-mev-bot-jaredfromsubway-threatens-181233304.html"}]}],"sources_used":[{"credibility":1,"name":"Sandwich Attack: How JaredfromSubway Lost $7.5M - Chainalysis","type":"research","url":"https://www.chainalysis.com/blog/sandwich-attack-jaredfromsubway-hack/"},{"credibility":1,"name":"Ethereum's biggest sandwich bot drained of $7.5 million in ironic exploit - CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/06/21/ethereum-s-biggest-sandwich-bot-drained-of-usd7-5-million-in-ironic-exploit"},{"credibility":1,"name":"Vitalik Buterin gets sandwiched by JaredfromSubway as Ethereum MEV risks linger - CoinDesk","type":"news_article","url":"https://www.coindesk.com/tech/2026/05/07/jaredfromsubway-bot-front-runs-vitalik-buterin-s-usd4-token-swap-with-usd1-million-in-volume"},{"credibility":2,"name":"Notorious jaredfromsubway MEV bot drained for roughly $7.5 million in counter-MEV honeypot - The Block","type":"news_article","url":"https://www.theblock.co/post/405464/notorious-jaredfromsubway-mev-bot-drained-for-roughly-7-5-million-in-counter-mev-honeypot"},{"credibility":2,"name":"Jaredfromsubway.eth is back with a new MEV bot and new sandwich attacks - The Block","type":"news_article","url":"https://www.theblock.co/post/312245/jaredfromsubway-eth-is-back-with-a-new-mev-bot-and-new-sandwich-attacks"},{"credibility":2,"name":"Jaredfromsubway.eth's MEV bot rakes in millions of dollars in three months - The Block","type":"news_article","url":"https://www.theblock.co/post/230218/jaredfromsubway-mev-bot"},{"credibility":2,"name":"Jaredfromsubway.eth Ethereum's Most Active Sandwich Bot Drained for $7.5M - The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/jaredfromsubway-eth-mev-bot-drained-7-5-million-counter-mev-honeypot"},{"credibility":2,"name":"MEV bot JaredFromSubway.eth loses $7.5M to approvals honeypot - Protos","type":"news_article","url":"https://protos.com/mev-bot-jaredfromsubway-eth-loses-7-5m-to-approvals-honeypot/"},{"credibility":2,"name":"Ethereum MEV Bot JaredFromSubway Threatens Legal Action After $7.5 Million Loss - Decrypt","type":"news_article","url":"https://decrypt.co/371787/ethereum-mev-bot-jaredfromsubway-legal-action-7-5-million-attack"},{"credibility":2,"name":"DeFi's most notorious bot makes record 2024 profit targeting ENA traders - DL News","type":"news_article","url":"https://www.dlnews.com/articles/defi/mev-bot-jaredfromsubway-attacks-ethena-traders-on-ethereum/"},{"credibility":2,"name":"20 transactions, $5.1M transferred to Tornado Cash - AMBCrypto","type":"news_article","url":"https://ambcrypto.com/20-transactions-5-1m-transferred-to-tornado-cash-aftermath-of-the-jaredfromsubway-eth-attack/"},{"credibility":2,"name":"$5.1 Million Hits Tornado Cash in 20 Transactions After jaredfromsubway.eth Exploit - The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/altcoins/5-1-million-hits-tornado-cash-in-20-transactions-after-jaredfromsubway-eth-exploit-269602"},{"credibility":2,"name":"Jaredfromsubway Hacker Ignores 50% Bounty, Routes Funds to Tornado Cash - CryptoPotato","type":"news_article","url":"https://cryptopotato.com/jaredfromsubway-hacker-ignores-50-bounty-routes-funds-to-tornado-cash/"},{"credibility":2,"name":"Jaredfromsubway.eth MEV Bot Exploited for $7.5M - What Builders Need to Know - thirdweb","type":"research","url":"https://blog.thirdweb.com/jaredfromsubway-eth-mev-bot-exploited-for-7-5m-what-builders-need-to-know/"},{"credibility":2,"name":"JaredFromSubway MEV Bot Drained via Counter-MEV Honeypot and Fake Token Approvals - Mallory","type":"research","url":"https://www.mallory.ai/stories/019eefdf-6843-7a09-bed5-b17a2a3e5643"},{"credibility":2,"name":"Sandwich bots filch millions off unwitting investors during meme coin rally - DL News","type":"news_article","url":"https://www.dlnews.com/articles/markets/memecoin-pepe-sandwich-bots-219m-mev/"},{"credibility":3,"name":"How a Fake MEV Opportunity Cost JaredFromSubway.eth $7.5M - DEV Community","type":"research","url":"https://dev.to/cryip/how-a-fake-mev-opportunity-cost-jaredfromsubwayeth-75m-52gn"},{"credibility":3,"name":"Investigation of the MEV Sandwich Bot jaredfromsubway.eth - CryptoMEVBot","type":"research","url":"https://cryptomevbot.com/blog/jaredfromsubway-mev-bot-analysis"}],"summary":"JaredFromSubway.eth is a pseudonymously operated Ethereum MEV (Maximal Extractable Value) sandwich-attack bot that rose to infamy in 2023 and became responsible for an estimated 70% of all sandwich attacks on the Ethereum network between November 2024 and October 2025. On June 20, 2026, an unknown attacker reversed the bot's predatory logic against it, deploying 66 fake token contracts and fake liquidity pools to manipulate the bot into granting persistent token spending approvals, then sweeping approximately $7.5 million in WETH, USDC, and USDT in a single coordinated drain transaction. The stolen funds were subsequently routed through Tornado Cash, and the bot's operator — who offered a 50% white-hat bounty — has alleged they will pursue legal and law-enforcement remedies.","timeline":[{"date":"2023-02-21","event":"JaredFromSubway.eth MEV bot first deployed on Ethereum mainnet.","source":"CryptoMEVBot analysis","source_url":"https://cryptomevbot.com/blog/jaredfromsubway-mev-bot-analysis"},{"date":"2023-04-18","event":"Bot generates over $2 million in profit from 24,000+ sandwich attacks in two days during the PEPE memecoin trading frenzy, using $100 million in daily PEPE volume.","source":"DL News","source_url":"https://www.dlnews.com/articles/defi/mev-bot-jaredfromsubway-attacks-ethena-traders-on-ethereum/"},{"date":"2023-06-01","event":"Bot reported to appear in over 60% of all Ethereum blocks at peak operational intensity, executing millions of transactions.","source":"The Block","source_url":"https://www.theblock.co/post/230218/jaredfromsubway-mev-bot"},{"date":"2024-04-03","event":"Bot records one of its best single trading days, generating approximately $300,000 in profits by targeting Ethena (ENA) token traders on the day of ENA's airdrop launch, with $14.8 million in ENA volume processed.","source":"DL News","source_url":"https://www.dlnews.com/articles/defi/mev-bot-jaredfromsubway-attacks-ethena-traders-on-ethereum/"},{"date":"2024-08-14","event":"Operator allegedly deploys a new contract address ('Jared 2.0'), deprecating the original. The new address, created by the same key pair, begins executing more sophisticated multi-layer sandwich attacks.","source":"The Block","source_url":"https://www.theblock.co/post/312245/jaredfromsubway-eth-is-back-with-a-new-mev-bot-and-new-sandwich-attacks"},{"date":"2026-04-30","event":"Bot sandwich-attacks Ethereum co-founder Vitalik Buterin's swap of 26,544 XDB tokens for ETH, deploying $1.14 million in WETH to manipulate prices across SushiSwap and Uniswap V2. The bot fails to profit after gas fees.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/05/07/jaredfromsubway-bot-front-runs-vitalik-buterin-s-usd4-token-swap-with-usd1-million-in-volume"},{"date":"2026-06-20","event":"Unknown attacker executes counter-honeypot exploit across approximately 97 blocks using 66 fake token contracts and fabricated liquidity pools, draining approximately $7.5 million (1,475 WETH, $2.9M USDC, $2M USDT) from the bot in a single coordinated drain transaction.","source":"CoinDesk / Blockaid / Protos","source_url":"https://www.coindesk.com/tech/2026/06/21/ethereum-s-biggest-sandwich-bot-drained-of-usd7-5-million-in-ironic-exploit"},{"date":"2026-06-22","event":"Bot operator posts on-chain message offering a 50% white-hat bounty (approximately 2,150 ETH, roughly $3.7 million) for return of stolen funds within 48 hours, threatening legal and law-enforcement action otherwise.","source":"Decrypt","source_url":"https://decrypt.co/371787/ethereum-mev-bot-jaredfromsubway-legal-action-7-5-million-attack"},{"date":"2026-06-24","event":"Attacker ignores bounty deadline and routes approximately $5.1 million of stolen funds through Tornado Cash in 20 uniform 100-ETH transactions. Remaining approximately 1,422 ETH is converted to DAI stablecoin.","source":"AMBCrypto / The Currency Analytics","source_url":"https://ambcrypto.com/20-transactions-5-1m-transferred-to-tornado-cash-aftermath-of-the-jaredfromsubway-eth-attack/"}]},"v":1}