JaredFromSubway MEV Bot Loses $7.5M to Exploit

On Saturday, the automated trading bot JaredFromSubway lost about $7.5 million after an attacker used fake tokens and fraudulent smart contracts to exploit the bot’s permission logic.

The bot scans the Ethereum mempool for profitable trade patterns and executes so-called sandwich trades by placing orders around pending transactions. To carry out some trades, the bot grants other addresses permission to move funds on its behalf.

Security firm Blockaid reported the attacker presented crafted transactions that did not revoke delegated approvals, unlike earlier transactions that revoked permissions immediately. Blockaid wrote, “That left attacker-controlled spenders armed.” The attacker then withdrew legitimate assets from the bot’s wallet instead of capturing small trade profits.

The bot’s operator posted an on-chain message offering a 50% “white hat bounty” for the return of 2,150 ETH, roughly $3.7 million, within 48 hours. The operator warned they would pursue legal remedies and involve law enforcement if the funds were not returned.

Blockchain analysis firm PeckShield reported the attacker converted some stolen wrapped Ethereum and stablecoins and moved part of the proceeds through Tornado Cash.

Observers on-chain reacted to the bounty and the theft. One comment read, “Finally, someone punished the infamous sandwich attacker.” Other responses questioned whether the exploiter would accept the offer.

JaredFromSubway is known for using sandwich strategies to extract value from transaction ordering. The incident involved deceptive contracts and timing that left the bot’s delegated approvals exposed.

Security teams recommend limiting long-lived approvals and adding checks before interacting with unknown tokens or contracts. The operator described the bounty as a partial recovery mechanism while reserving the right to pursue legal and enforcement options.