WuBlockchain
Ethereum MEV bot JaredFromSubway lost approximately $7.5 million on Sunday after attacker-controlled contracts tricked its automated execution system into granting token approvals, according to blockchain security firm Blockaid. The attacker later used those allowances to drain WETH, USDC, and USDT from the bot's wallet.
Blockaid stressed the incident was neither a phishing attack nor a smart-contract vulnerability — the exploit targeted the bot's automated MEV opportunity detection and approval mechanism, the very infrastructure designed to capture sandwich and arbitrage flow on Ethereum.
Why it matters
JaredFromSubway is among the most active and best-known MEV bots on Ethereum, having extracted tens of millions of dollars in profit over its lifetime. A $7.5M loss to a single bot is a meaningful on-chain event, but the structural read is bigger: when the same automated approval pattern that lets a bot move fast on MEV opportunities can be weaponised against the bot itself, the attack surface for the broader MEV ecosystem widens.
Market impact
The drained assets were primarily stablecoins and wrapped ETH, meaning the impact flows through the bot's operators rather than any specific token's liquidity profile. Blockaid's framing — exploit of approval logic, not protocol vulnerability — leaves WETH, USDC, and USDT contracts unaffected. Watch whether competing MEV bots tighten approval spend caps or rotate signer infrastructure in response; a copycat wave against similar automated strategies is the realistic second-order risk.
Frequently asked questions
-
What happened to the MEV bot JaredFromSubway?
The Ethereum MEV bot JaredFromSubway lost approximately $7.5 million after attacker-controlled contracts tricked its automated execution system into granting token approvals, which the attacker then used to drain WETH, USDC, and USDT.
-
Was this a smart-contract hack or phishing attack?
No. According to Blockaid, the incident was neither phishing nor a smart-contract vulnerability — it exploited the bot's own automated MEV opportunity detection and approval mechanism.
-
Which tokens were stolen from JaredFromSubway?
The attacker drained WETH, USDC, and USDT from the bot's wallet using the token allowances they had tricked it into granting.
-
Does this exploit affect WETH, USDC, or USDT protocols?
No. Blockaid framed the incident as an exploitation of the bot's approval logic, not a vulnerability in the token contracts themselves — WETH, USDC, and USDT remain unaffected at the protocol level.
-
Why is this exploit significant for the MEV ecosystem?
JaredFromSubway is one of the most active and profitable MEV bots on Ethereum. The attack shows the same automated approval infrastructure that lets MEV bots move fast can be weaponised against them, expanding the attack surface for similar automated strategies.
TheBlock
Lookonchain
CoinTelegraph
CoinDesk