Ethereum

Bio Protocol

WETH

Uniswap

USDC

<p>Ethereum’s well-known MEV bot JaredFromSubway was drained after an attacker used contracts that made its automated trading system grant token approvals, according to <a href="https://x.com/blockaid_/status/2068433798757577198?s=20" rel="noopener noreferrer nofollow">Blockaid</a>.</p>
<div id="cn-block-summary-block_7f29ca2d79eea6fc0837e51f1d06d0f4" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>Blockaid says attacker-controlled contracts tricked JaredFromSubway’s automated system into granting approvals later used for draining.</li>
   <li>Jared publicly claimed a $15 million loss, while Blockaid’s public estimate stood near $7.5 million.</li>
   <li>Crypto.news previously tied JaredFromSubway to Vitalik Buterin’s swap and heavy Ethereum gas use in 2023.</li>
  </ul>
 </div>
</div>
<p>The security firm said the incident was not a normal phishing case and not a direct bug in the victim contract.&nbsp;</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p>“This is not a classic phishing attack and not a traditional smart-contract vulnerability in the victim contract,” Blockaid said.&nbsp;</p>
</blockquote>
<p>The firm said the bot approved attacker-controlled contracts during routes that appeared to be profitable MEV trades.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>🚨Community Alert:<br>Blockaid Exploit Detection system detected an exploit involving the <a href="https://x.com/jaredsmev?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@jaredsmev</a> MEV bot on Ethereum.<br>The incident resulted from attacker-controlled contracts tricking an automated MEV execution system into granting token approvals, later used to drain funds.…</p>— Blockaid (@blockaid_) <a href="https://x.com/blockaid_/status/2068433798757577198?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 20, 2026</a>
  </blockquote>
 </div>
</figure>
<p>You might also like: <a href="https://crypto.news/ian-cohen-battles-238b-bitcoin-grab-targeting-satoshi-wallets/" rel="noopener noreferrer nofollow"> Ian Cohen battles $238B Bitcoin grab targeting Satoshi wallets </a></p>
<h2 class="wp-block-heading" id="strong-blockaid-says-approvals-stayed-open-strong"><strong>Blockaid says approvals stayed open</strong></h2>
<p>Blockaid said the attacker first tested routes where approvals were used at once, leaving no open allowance. Later, the attacker changed the route design so the bot gave approvals that were not spent or revoked.</p>
<p>One example cited by Blockaid involved an approval of about 92.16 WETH to an attacker helper contract. <a href="https://etherscan.io/tx/0x85609286d68bd47065772c21fd9542c4343348ff8c7c2e6d63d0692be5781915" rel="noopener noreferrer nofollow">Etherscan data</a> for the transaction showed jaredfromsubway.eth interacting with its MEV Bot 2 contract before the later sweep. The transaction record also showed ERC-20 movements tied to the same automated route.</p>
<h2 class="wp-block-heading" id="strong-final-sweep-hit-weth-usdc-and-usdt-strong"><strong>Final sweep hit WETH, USDC and USDT</strong></h2>
<p>The final transaction used the open approvals to pull WETH, USDC and USDT from the JaredFromSubway MEV bot contract through transferFrom. <a href="https://etherscan.io/tx/0x2be8704f5a59b69e0b71f64aefdb99eb0e8ae9fb3926147c581910d71bcf3e65" rel="noopener noreferrer nofollow">Etherscan showed</a> transfers from “jaredfromsubway: MEV Bot 2” to the attacker wallet beginning with 0x3e37.</p>
<p>Blockaid put the drained amount at about $7.5 million. The <a href="https://x.com/jaredsmev/status/2068481862499237929?s=20" rel="noopener noreferrer nofollow">JaredFromSubway account</a> later claimed the loss was $15 million and offered a $1 million bounty for the full return of the funds. That difference has not been fully explained in the public posts reviewed.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>🚨 Major incident: My MEV bot JaredFromSubway.eth was just drained for $15M<br><br>I am offering a $1,000,000 USD bounty for the full return of the funds<br><br>No Q asked. Full confidentiality and safe return guaranteed. This is a legitimate, time-sensitive bounty.<br>Contact me privately. <a href="https://t.co/5VXfdg9tap" rel="noopener noreferrer nofollow">https://t.co/5VXfdg9tap</a></p>— Jaredfromsubway.eth (@jaredsmev) <a href="https://x.com/jaredsmev/status/2068481862499237929?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 20, 2026</a>
  </blockquote>
 </div>
</figure>
<h2 class="wp-block-heading" id="strong-how-the-attacker-turned-the-bot-s-logic-against-it-strong"><strong>How the attacker turned the bot’s logic against it</strong></h2>
<p>The attack appears to have targeted the bot’s own trading workflow. MEV bots watch Ethereum activity and act on transactions that look profitable. In this case, attacker-controlled contracts made the route look useful enough for the bot to approve spending rights.</p>
<p>The attacker used 66 fake token contracts that copied the look and function of WETH, USDC and USDT. These contracts were paired with fake liquidity pools. The setup pushed the bot toward approvals that later became the path for the drain.</p>
<h2 class="wp-block-heading" id="strong-jaredfromsubway-s-record-is-back-in-focus-strong"><strong>JaredFromSubway’s record is back in focus</strong></h2>
<p>JaredFromSubway is one of Ethereum’s most watched sandwich bots. In a sandwich attack, a bot places trades before and after a user’s swap. This can give the user a worse price while the bot captures the spread.</p>
<p>As <a href="https://crypto.news/ethereums-most-notorious-sandwich-bot-targets-vitalik-buterins-swap/" rel="noopener noreferrer nofollow">previously reported by crypto.news</a>, JaredFromSubway targeted a small swap by Ethereum co-founder Vitalik Buterin in April, using about $1.14 million in WETH volume across SushiSwap and Uniswap V2. Crypto.news also <a href="https://crypto.news/mev-bot-consumes-7-of-eth-gas-while-sandwiching-traders/" rel="noopener noreferrer nofollow">reported in 2023</a> that the bot used 455 ETH in gas within 24 hours and accounted for about 7% of Ethereum gas use during that period.</p>
<p>The exploit now puts attention on token approvals used by automated systems. The case shows how a system built to act quickly on open market data can be steered into unsafe permissions when controls around approvals are weak. It also adds a new chapter to the wider debate over MEV, sandwich trades and user protection on Ethereum.</p>
<p>For now, the key public details remain split between Blockaid’s technical thread, the on-chain records and posts from the JaredFromSubway account. No recovery had been confirmed in the reviewed updates.</p>
<p>Read more: <a href="https://crypto.news/bio-protocol-launches-ai-research-hub-to-challenge-grant-gatekeepers/" rel="noopener noreferrer nofollow"> Bio Protocol launches AI research hub to challenge grant gatekeepers </a></p>

JaredFromSubway MEV bot gets drained in $7.5m approval trap

Table of Contents

crypto.news

Other articles published on Jun 21, 2026

Join our free newsletter for daily crypto updates!