Irony abounds as infamous ‘sandwich’ bot exploited for $7.7M

An infamous “sandwich” bot was exploited for $7.7 million in a hack dripping with irony.

Jaredfromsubway.eth is a maximal extractable value (MEV) bot that specializes in sandwich attacks, in which an attacker sees a trade waiting to be executed and makes the same buy directly before the trade and sells immediately after it. The way it works is that the sandwiched trade raises the price of the cryptocurrency being bought, letting the bot sell at a profit.

For example, if a buyer sets a $100 trade, it will jack the price up to $101. So the automated sandwich bot buys directly in front of the original trade, which now pays the $101 price. The sandwich bot then sells immediately after the original trade, locking in $1 profit at the expense of the original trader.

Multiplied by thousands of trades, these small attacks — while legal — add up to substantial tax on traders. According to Web3 development platform Thirdweb, Ethereum suffers 60,000 to 90,000 sandwich exploits every month, accounting for $60 million in annual losses. Jaredfromsubway.eth is responsible for about 70% of those attacks.

In the hack of jaredfromsubway.eth, the hacker deployed scores of fake token contracts and liquidity pools that appeared to be profitable trades, drawing its attention. After several weeks of this, the hacker deployed contracts that tricked the automated MEV system into granting approvals to spend tokens on its behalf that let the hacker drain $7.7 million, according to Blockaid.

In all, about 4,427 ETH were drained from jaredfromsubway.eth, according to Lookonchain. So far, about 1,000 ETH have been sent to cryptocurrency mixer Tornado Cash to launder the stolen funds.

As Global Whales put it on X.com, “even the predators get hunted.”