A well-known Ethereum MEV bot called JaredFromSubway has been drained of approximately $7.5 million, according to security firm Blockaid. The incident did not involve a typical phishing attack or a direct vulnerability in the bot’s smart contract, but rather a clever manipulation of the bot’s automated approval system.
Blockaid explained that the attacker deployed specially crafted contracts that tricked JaredFromSubway’s automated trading system into granting token approvals. These approvals were initially used and revoked during test transactions, but the attacker later altered the route design so that the bot issued approvals that were never spent or revoked, leaving them open for exploitation.
The final exploit involved pulling WETH, USDC, and USDT from the bot’s contract using the open approvals via transferFrom. Etherscan data shows transfers from jaredfromsubway: MEV Bot 2 to an attacker wallet. Blockaid estimates the loss at around $7.5 million, but JaredFromSubway’s account later claimed the loss was $15 million and offered a $1 million bounty for the return of funds, with the discrepancy remaining unexplained.
The attack targeted the bot’s trading workflow. MEV bots monitor Ethereum for profitable transactions, and in this case, attacker-controlled contracts made a fake profitable route appear legitimate, leading the bot to approve spending rights. The attacker used 66 fake token contracts mimicking WETH, USDC, and USDT, paired with fake liquidity pools, to steer the bot into granting approvals that later enabled the drain.
JaredFromSubway is one of Ethereum’s most notorious sandwich bots, which places trades before and after a user’s swap to capture price spreads. It previously made headlines for targeting a swap by Ethereum co-founder Vitalik Buterin in 2023 and consuming about 7% of Ethereum’s gas in a single day. This exploit highlights the risks of token approvals in automated systems and adds to ongoing debates about MEV and user protection on Ethereum.