Thread about the JaredFromSubway MEV bot exploit
1/ Insane exploit on one of Ethereum’s most notorious MEV bots.
JaredFromSubway.eth — the sandwich attack bot that has extracted tens of millions from traders since 2023 — just got drained for ~$7.5M+ in one of the cleanest and most sophisticated attacks I’ve seen.
No contract vulnerability. No phishing. The bot essentially approved its own robbery.
2/ Here’s exactly how it happened:
The attacker didn’t hack the bot’s code. Instead, they weaponized the bot’s own logic against it.
They deployed:
* Fake wrapper tokens (fWETH, fUSDC, fUSDT)
* Fake liquidity pools on DEXes that looked highly profitable for arbitrage/sandwich opportunities
3/ The bot, constantly scanning for MEV opportunities, spotted these fake pools and thought it had found a juicy trade.
As part of its normal automated process, it granted approval to attacker-controlled helper contracts to spend its tokens.
In early test transactions, these approvals were actually used (small amounts), so nothing looked suspicious.
4/ Then came the critical part:
In later transactions, the bot granted large approvals that were never consumed or revoked.
This gave the attacker unlimited spending power over the bot’s funds through those helper contracts.
5/ Once enough approvals were in place, the attacker executed the final drain using transferFrom.
They pulled large amounts of WETH, USDC, and USDT directly from the JaredFromSubway contract.
Example from on-chain data:
* Multiple transfers of ~92 WETH
* Multiple transfers of ~143k USDC
* Multiple transfers of ~149k USDT
All going to the attacker’s helper address: 0x3e37f4A10d771Ba9dE44b6d301410b1BEdeA65d0
6/ The bot’s address (for verification):
jaredfromsubway.eth → 0xae2fc483527b8ef99eb5d9b44875f005ba1fae13
Arkham Intelligence tracked the hit across 95 addresses. The bot’s balance reportedly dropped from ~$25M to ~$4.4M.
Some funds were later moved through Tornado Cash.
7/ Why this attack was so effective:
MEV bots are designed to act fast and trust opportunities that look profitable. This attacker created a fake opportunity that perfectly matched what the bot was programmed to chase.
The exploit turned the bot’s automation and lack of strict approval management into a liability.
8/ Key takeaway:
Even sophisticated MEV bots (and their operators) must be extremely careful with token approvals.
Always revoke unused approvals.
This applies to regular users and automated bots alike.
This attack is a masterclass in social engineering on-chain — no code was broken, only trust and automation were exploited.
The hunter became the hunted.
What are your thoughts on this exploit? Have you seen similar approval-based attacks before?
Fuente:
· Forbes, ranking de clubes de fútbol más valiosos, mayo 2026
· Valoración = patrimonio neto + deuda, con ingresos y estadio
· Cifras en dólares
Reflexión ↓↓↓
Porcentaje de personas que NUNCA han usado tarjeta de crédito:
🇮🇳 India: 78%
🇩🇪 Alemania: 53%
🇯🇵 Japón: 32%
🇸🇪 Suecia: 8%
🇺🇸 Estados Unidos: 17%
La cultura financiera lo cambia todo.
Fuente: World Bank Global Findex Database, 2024
Los países con más trabajo en negro de Latinoamérica
[Ranking histórico]
⠀
🥉 Economía sumergida
⠀
🇲🇽 México — casi la mitad, informal
🇨🇴 Colombia — más del 55%
🇭🇳 Honduras — empleo precario
🇬🇹 Guatemala — mayoría sin contrato
⠀
🥈 Casi todo en negro
⠀
🇵🇪 Perú — más del 70%
🇳🇮 Nicaragua — informalidad masiva
⠀
🥇 El país con más empleo informal
⠀
↓
I'm dead serious Justin Gaethje ended Ilia Topuria's career tonight. You don't take that level of damage & come back the same from it.
RIP Topuria's career
#ufc
Lowkey another pandemic is the most bullish thing that could happen to the trenches right now.
Everyone locked in their basements with nothing to do,
Just a screen, a wallet and an overwhelming need for adrenaline.
That's EXACTLY what we had in the greatest cycle in 2021..
normies were sitting at home bored out of their minds,
govt sending stimulus cheques,
And the only thing open was the crypto casino.
You give a few million normies nothing to spend money on and nowhere to go,
Every single dollar ends up in shitcoins within 2 weeks.
If lockdown 2.0 ever happens the trenches will come alive so fast it'll make 2021 look tame.
I give it less than 5% chances.. but let us dream