Ethereum MEV bot jaredfromsubway.eth loses $7.5M in attack

A prominent automated trading bot on the Ethereum blockchain, known as jaredfromsubway.eth, has been drained of more than $7.5 million in a sophisticated attack that turned the bot’s own profit-seeking logic against it. The incident, which occurred on Saturday, June 20, 2026, was described by security firm Blockaid as a novel “counter-MEV honeypot” attack rather than a traditional smart contract bug or phishing scam.

According to Blockaid, the attacker spent several weeks deploying 66 fake token contracts and liquidity pools designed to mimic legitimate assets like Wrapped Ether (WETH), USDC, and USDT. These counterfeit setups were crafted to appear as profitable trading opportunities. The jaredfromsubway.eth bot, which is programmed to automatically scan for such opportunities, interacted with the fake contracts and granted token approvals to attacker-controlled “helper” contracts. These approvals gave the attacker standing permission to spend the bot’s funds. In a single transaction, the attacker then used these permissions to sweep millions of dollars worth of WETH, USDC, and USDT from the bot’s treasury. On-chain data indicates some of the stolen funds were subsequently...