MEV Bot Jaredfromsubway.eth Drained for $7.5M

One of the most successful MEV bots in crypto, Jaredfromsubway.eth, was drained for more than $7.5 million after an attacker exploited the bot’s automated execution systems, the same systems that have generated hundreds of millions over the years. Blockaid said on X the incident occurred Saturday when attacker-controlled contracts tricked the bot into granting token approvals later used to drain funds.

"This is not a classic phishing attack and not a traditional smart-contract vulnerability in the victim contract," Blockaid added. The attacker created fake wrapper tokens and pools — including fake Wrapped Ether (fWETH), fake USDC (fUSDC) and fake USDt (fUSDT) routes paired with fake Cap (fCAP) — designed to look like profitable trades the bot is programmed to chase.

That prompted the bot to approve attacker-controlled helper contracts to spend real tokens; unusually, the crafted routes allowed those approvals to remain open instead of being consumed during the trade.

mev bot, jaredfromsubway.eth, drained funds, token approvals, fake tokens, fweth, fusdc, fusdt, attacker contracts, blockaid