BreachPublished 22 Jun 2026

JaredFromSubway MEV bot hacked in $15 million crypto theft

Source Bleeping Computer

Description

The JaredFromSubway Ethereum MEV (Maximal Extractable Value) bot suffered a $15 million loss after an attacker manipulated the opportunity-detection logic by creating fake cryptocurrency trading opportunities. [...]

Impact

The attacker successfully stole $15 million worth of cryptocurrencies (WETH, USDC, USDT) by abusing the bot's logic to approve malicious contracts. This financial loss impacts the bot operator directly and highlights vulnerabilities in automated MEV bot logic related to opportunity detection and token approval management.

Defensive guidance

JaredFromSubway has not publicly released a fix or patch. The operator has offered bounties to recover stolen funds and is negotiating with white-hat hackers. Until an official fix or update is provided, users and operators of similar MEV bots should exercise caution with automated token approvals and consider manual review or additional validation of detected opportunities.

Summary

An attacker exploited the JaredFromSubway Ethereum MEV bot by creating fake pools and tokens that appeared as profitable MEV opportunities. The bot's automated system granted ERC-20 token approvals to attacker-controlled helper contracts, which were not revoked or consumed immediately, allowing the attacker to accumulate spending permissions. The attacker then used these approvals to withdraw approximately $15 million in various cryptocurrencies from the bot's contract via the transferFrom function. The bot operates by scanning Ethereum for MEV opportunities, including sandwich attacks. The incident was detected by blockchain security firm Blockaid.

References

bleepingcomputer.com/news/security/jaredfromsubway-mev-bot-hacked-in-15-million-crypto-theft/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 22 Jun 2026, 22:09 UTC

References

Community reviews