In June of this year, an unidentified attacker deployed 66 counterfeit token contracts on Ethereum, disguising them under familiar names like WETH, USDC, and USDT. The target was not a retail user's wallet, but Jaredfromsubway.eth — the most active operator of 'sandwich attacks' on the network.
Over the next few hours, the bot's own automated trading logic operated as usual: scanning for arbitrage opportunities involving the counterfeit tokens and, in doing so, granting token spending approvals to the attacker's malicious contracts. Once sufficient approvals had accumulated, the attacker drained the bot's real assets in a coordinated series of transactions, stealing at least $7.5 million in $ETH and stablecoins, then laundering the proceeds through Tornado Cash.
To date, none of these funds have been recovered.
The irony was not lost on the Ethereum research community: a bot created to exploit the 'blind spots' of other traders was taken down by the very mechanism that makes its own business model possible.
However, this incident also underestimated the scale this business has reached. Trackers monitoring every $ETH transfer into the bot's main contract show that as of August 28th, cumulative revenue amounted to 117,007 $ETH, steadily accrued since the first recorded withdrawal from the contract in March 2023.
What MEV Really Is
Maximal Extractable Value (MEV) is the profit that a block producer (or anyone who can influence which transactions get into a block and in what order) can gain by inserting, reordering, or excluding transactions. It exists because Ethereum's mempool, where pending transactions wait to be included, is publicly visible before it becomes final. Anyone monitoring this mempool can see a large pending trade and take advantage of that information before it is completed.
The 'sandwich attack' is the most consumer-hostile form of MEV. When a trader submits a swap order large enough to affect a token's price on a decentralized exchange, a bot detects it in the mempool, sends its own buy order right before the victim's transaction (paying a higher gas fee to ensure it goes first), allows the victim's trade to execute at the now less favorable price, and then immediately sells at the price inflated by the victim's own trade.
The victim's permissible slippage (i.e., the maximum price change they are willing to accept) becomes the bot's profit margin. No hacking, no vulnerabilities, no smart contract bugs — it's a pure consequence of transaction ordering, repeated thousands of times a day.
MEV is not a new phenomenon, as researchers described miners reordering transactions for profit as far back as 2019, and the term itself was coined in 2019 in an academic paper on 'miner extractable value.' The game changed with Flashbots — a research organization founded in 2020 that created the first private auction system for MEV, aiming to move this practice out of the public mempool and into an organized bidding process.
The Ethereum community dubbed the pre-Flashbots mempool the 'dark forest' — a place where any visible transaction carrying value could be attacked within seconds. MEV-Boost, launched concurrently with Ethereum's transition to Proof-of-Stake (PoS) in 2022, made this private auction model the standard way blocks are built today.
The Mechanism Behind Every Block
Sandwich bots cannot choose block order by themselves; they compete for it via MEV-Boost — an off-protocol auction system that over 90% of Ethereum validators use to outsource block building. In MEV-Boost, specialized 'builders' assemble full blocks and submit bids to 'relays,' which verify the blocks and pass the highest bid to the validator scheduled to propose the next block. The validator chooses blindly, seeing only the bid amount, not the block contents, and then signs the block offering the highest sum.
This auction has concentrated in the hands of a few players. A recent snapshot from relayscan.io — an MEV-Boost monitor run by Flashbots — shows relay.ultrasound.money handling 34.0% of data over a 24-hour period, Titan Relay at 28.5%, and the regulated relay bloXroute at 25.0% (meaning the three relays collectively route roughly 85–88% of all MEV-Boost blocks).
Builder concentration is even more pronounced: Titan's proprietary builder assembles a full 50.3% of blocks, with Quasar and Buildernet each claiming about 16%. Essentially, one company determines transaction order for half of Ethereum's blocks in any given interval — exactly the centralization risk critics of MEV-Boost warned about since its 2022 launch.
In other words, a dominant builder can selectively include, exclude, or reorder transactions with virtually no competitive oversight.
Sandwich Attacks Are Shrinking, But Not Fast Enough
Despite staggering lifetime totals for bots like JaredfromSubway, there is a silver lining: the economics of sandwich attacks are quietly declining overall. Data from a dataset containing over 95,000 attacks shows monthly sandwich extraction volume fell from roughly $10 million in late 2024 to about $2.5 million in October 2025 — a 75% drop in less than a year.
The main credit for shrinking this margin goes to traders using MEV protection tools (be it private RPCs or order flow auctions that keep pending trades out of the public mempool scanned by sandwich bots).
Nevertheless, analysts still estimate trader losses from sandwich attacks at around $60 million annually at the peak of this strategy's popularity — and this figure indirectly benefits blockchain builders as well, since a significant share of MEV profit ultimately goes to them as priority fees that bots pay to ensure their transactions land in the right order.
Ethereum's Roadmap Holds a Structural Solution
Looking ahead, the enshrined Proposer-Builder Separation (ePBS) module, part of the planned Glamsterdam upgrade, will move today's off-protocol MEV-Boost auction into the network's consensus rules, eliminating relays as trusted intermediaries and giving validators cryptographic guarantees about block contents without needing to trust a builder or relay operator.
However, until that upgrade is released and live, an honest assessment of the MEV situation on Ethereum remains characterized by a looming uncertainty.
end-content
