Ethereum Sandwich Bot Earned $295M Before Losing $7.5M in a Counter‑Attack

A contract identified as JaredfromSubway.eth’s sandwich bot has accumulated more than 117,000 ETH, valued at roughly $295 million, by repeatedly front‑running large trades on decentralized exchanges since March 2023. In June 2026 the bot was targeted by an anonymous attacker who deployed 66 counterfeit token contracts, resulting in a loss of at least $7.5 million in ETH and stablecoins.

How the Sandwich Bot Operated

The bot monitored Ethereum’s public mempool for sizable swap orders. When it detected a trade that would move a token’s price, it submitted a higher‑fee transaction to buy the token just before the victim’s order, let the victim’s trade execute at the inflated price, and then sold the token immediately after, pocketing the price difference. This “sandwich” pattern generated the bot’s massive ETH haul.

Attack Methodology

In June 2026 the attacker created 66 fake token contracts mimicking well‑known assets such as WETH, USDC, and USDT. The bot’s automated logic treated these contracts as legitimate, granting token‑spending approvals to the attacker’s addresses. Once sufficient approvals were in place, the attacker executed a coordinated series of transactions that swept the bot’s real ETH and stablecoin balances. The stolen funds were subsequently moved through Tornado Cash, and none have been recovered.

MEV‑Boost Infrastructure and Centralization

Sandwich bots compete for block space via MEV‑Boost, an auction system used by over 90 % of Ethereum validators. Relays such as ultrasound.money, Titan Relay, and bloXroute collectively route about 85 % of MEV‑Boost blocks. Builder operators, particularly Titan, construct roughly half of all blocks, highlighting a concentration risk in transaction ordering.

Trends in Sandwich‑Attack Profits

Analysis of over 95,000 sandwich attacks shows monthly extraction falling from around $10 million in late 2024 to about $2.5 million in October 2025, a 75 % decline. Adoption of MEV‑protection tools by traders is credited for this reduction, though annual losses at the strategy’s peak were estimated near $60 million.

Future Outlook

The upcoming Glamsterdam upgrade plans to integrate the proposer‑builder separation (ePBS) module into Ethereum’s consensus rules, aiming to eliminate reliance on external relays and provide cryptographic guarantees about block content. Until that upgrade is live, the MEV landscape remains subject to the centralization dynamics described above.