The operator of the long-running Ethereum MEV bot Jaredfromsubway.eth has suffered a $7.5 million exploit, with an attacker draining approximately 2,150 ETH from the bot’s contracts. In response, the operator publicly offered the hacker a 50% white-hat bounty if the full amount is returned within 48 hours, threatening legal action otherwise.
According to blockchain security firm Blockaid, the attack did not involve a private-key compromise or a conventional smart-contract bug. Instead, the attacker created fake trading routes and token contracts that mimicked legitimate assets, tricking the bot’s automated execution system into granting approvals. These approvals were then exploited to drain funds including WETH, USDC, and USDT.
The incident underscores persistent security risks in decentralized finance, particularly for automated trading systems that handle large sums. Known for aggressive sandwich attacks on decentralized exchanges, JaredFromSubway had long drawn criticism from DeFi users—making this a notable case of an extractor being extracted. The event may accelerate calls for clearer regulation and improved security standards in the MEV sector.
