Subway Token Swindler Out-Sandwiches the Sandwich King in $7.5M MEV Reverse 🧂

One of Ethereum's most prolific maximal-extractable-value bots, Jaredfromsubway.eth, was drained of roughly $7.5 million on Saturday after an attacker deployed 66 counterfeit token contracts that mimicked Wrapped ETH, USDC, and USDt, paired with fake liquidity pools designed to look like profitable trades. Security firm Blockaid said the incident was not a phishing attack, a private-key compromise, or a traditional smart-contract bug, but rather a "counter-MEV honeypot attack" that targeted the bot's automated, trust-minimized decision-making logic. "This is not a classic phishing attack and not a traditional smart-contract vulnerability in the victim contract," Blockaid said on X, adding that attacker-controlled contracts tricked Jaredfromsubway.eth's automated MEV execution system into granting token approvals that were later used to drain funds. Blockaid chief technology officer Raz Niv told Cointelegraph that one approval alone handed over more than 92 WETH, and that "ironically, in the process, it provided the attacker the keys to millions in the bot's treasury." A final contract then used those open allowances to sweep real funds, with the attacker calling all 66 backdoors in a single transaction.

The on-chain drain included 1,583 ETH, 2.87 million USDC, and 2.09 million USDT, according to figures cited by Blockaid and on-chain investigator PeckShield, which reported 1,474.58 WETH, 2.87 million USDC, and 2 million USDT. The proceeds were consolidated and swapped into 4,427 ETH, after which the attacker began laundering the funds through Tornado Cash in multiple transactions of 100 ETH each, valued at roughly $172,000 apiece, with at least 1,000 ETH entering the mixer in the early stages and Specter later reporting that about 20 such deposits had pushed approximately 2,000 ETH, or around $5.1 million, through Tornado Cash. The remaining 1,422 ETH was exchanged for roughly $2.44 million worth of DAI to reduce exposure to ETH price volatility. At the time of the exploit, ETH was trading close to $1,700, having fallen more than 8% over the prior week to $1,656.04 amid a broader market downturn.

Jaredfromsubway.eth rose to prominence in April 2023 when it burned more than $1 million in gas in a single day, nearly 8% of all Ethereum gas spending, front-running and back-running memecoin trades in so-called sandwich attacks. Cointelegraph Research previously found that sandwich attacks on Ethereum have resulted in about $60 million in annual losses for traders, with 60,000 to 90,000 such attacks per month between November 2024 and October 2025, roughly 70% of them associated with Jaredfromsubway.eth. In May, Ethereum co-founder Vitalik Buterin was sandwich attacked by the bot while swapping 26,544 DigitalBits, worth $2.11 at the time of writing, a loss that illustrated the indiscriminate reach of MEV extraction.

Following the exploit, the bot's operator posted an on-chain message offering a "50% white hat bounty" for the return of 2,150 Ethereum, valued at roughly $3.7 million, within 48 hours, and threatened legal action and law enforcement involvement otherwise. The operator also put the total loss closer to $15 million, while Blockaid and PeckShield valued the on-chain drain at about $7.5 million. Blockaid noted that some of the bot's legitimate transactions revoked approvals after completion, but the attacker's contracts "didn't," leaving attacker-controlled spenders armed. "We shouldn't be happy about this; no one should celebrate ... but if you've ever been sandwiched by this ... I'm pretty sure you're not upset about this news," crypto investor and commentator David Gokhshtein said. PeckShield has since flagged continued laundering activity, and Specter noted that "it looks like the attacker has no intention of returning any funds to jaredfromsubway," as investigators track efforts to break the on-chain trail.