Ethereum's top sandwich bot made $295M, then lost $7.5M

Jaredfromsubway.eth's sandwich bot extracted 117,007 ETH ($295 million) from Ethereum traders since March 2023, then lost $7.5 million to its own playbook in June.

According to Chainalysis, the attacker deployed 66 fake token contracts on Ethereum, dressed up as familiar names like WETH, USDC, and USDT. The target wasn't a retail wallet; it was the single most prolific sandwich-attack operator on the network.

Over the following hours, the bot's automated trading logic scanned for arbitrage opportunities in the fake tokens, granting token-spending approvals to the attacker's malicious contracts. Once enough approvals accumulated, the attacker swept the bot's real holdings in a coordinated sequence of transactions, draining at least $7.5 million in ETH and stablecoins before laundering the proceeds through Tornado Cash. None of the funds have been recovered.

The exploit shows how the same transaction-ordering mechanics that generate MEV profit can be weaponized against the bots themselves — and it comes as Ethereum's block-building infrastructure consolidates into a handful of operators, with three relays routing roughly 85 to 88 percent of all MEV-Boost blocks.

How MEV Works

MEV is the profit a block producer can capture by inserting, reordering, or excluding transactions. It exists because Ethereum's mempool — where pending transactions wait to be included — is publicly visible before it's final. A sandwich attack is MEV's most consumer-hostile form: when a trader submits a swap large enough to move a token's price on a decentralized exchange, a bot detects it in the mempool, submits its own buy order immediately before the victim's transaction, lets the victim's trade execute at the now-worse price, then immediately sells into the price the victim's own trade pushed up.

The victim's slippage tolerance becomes the bot's profit margin. No hack, no exploit, no smart contract bug — it's a pure function of transaction ordering, executed thousands of times a day.

The term "miner extractable value" was coined in a 2019 academic paper. Flashbots, founded in 2020, built the first private auction system for MEV, pulling the practice out of the public mempool. MEV-Boost, launched alongside Ethereum's 2022 transition to proof-of-stake, generalized that private-auction model into the default way blocks get built today.

Block-Building Concentration

Sandwich bots compete for block order through MEV-Boost, the out-of-protocol auction system that more than 90 percent of Ethereum validators use to outsource block construction. Specialized builders assemble full blocks and submit bids to relays, which validate and forward the highest bid to the validator scheduled to propose next.

A live snapshot from relayscan.io shows relay.ultrasound.money handling 34.0 percent of payloads over a 24-hour window, Titan Relay 28.5 percent, and bloXroute's regulated relay 25.0 percent. Builder concentration is starker: Titan's own builder operation assembles 50.3 percent of blocks outright, with Quasar and Buildernet each around 16 percent.

Despite the eye-popping lifetime numbers, the sandwich-attack economy is deflating. Data from a dataset of more than 95,000 attacks shows monthly sandwich extraction falling from roughly $10 million in late 2024 to about $2.5 million in October 2025 — a 75 percent decline in under a year. Traders adopting MEV-protection tools, such as private RPCs or order-flow auctions that keep pending trades out of the public mempool, get most of the credit.

The enshrined proposer-builder separation (ePBS) module, part of the planned Glamsterdam upgrade, will move today's off-protocol MEV-Boost auction into the network's consensus rules, removing relays as trusted middlemen. Until that upgrade ships, Ethereum's MEV environment remains one of looming uncertainty.

This article is for informational purposes only and does not constitute investment advice.