MEV Explained: Ethereum’s Top Sandwich Bot Made $295M, Then Lost $7.5M

The Hunter Becomes the Hunted

Earlier this twelvemonth successful June, an unidentified attacker deployed 66 fake token contracts connected Ethereum, dressing them up arsenic acquainted names similar WETH, USDC, and USDT. The people wasn’t a retail wallet; it was Jaredfromsubway.eth, the azygous astir prolific sandwich-attack relation connected the network.

Over the pursuing hours, the bot’s ain automated trading logic did what it ever does, i.e., scan for arbitrage opportunities successful the fake tokens and, successful doing so, assistance token-spending approvals to the attacker’s malicious contracts. Once capable approvals had accumulated, the attacker swept the bot’s existent holdings successful a coordinated series of transactions, draining astatine slightest $7.5 cardinal successful ETH and stablecoins earlier laundering the proceeds done Tornado Cash.

None of these funds person been recovered to date.

The irony isn’t mislaid connected the Ethereum probe assemblage arsenic a bot built to exploit different traders’ unsighted spots got taken down by the nonstop mechanics that makes its ain concern exemplary possible.

But the exploit besides undersold conscionable however ample that concern had become. Trackers pursuing each ETH transportation into the bot’s superior declaration amusement a cumulative haul of 117,007 ETH arsenic of Aug. 28, accumulated steadily since the contract’s archetypal recorded extraction successful March 2023.

What MEV Actually Is

Maximal Extractable Value (MEV) is the nett a artifact shaper (or anyone who tin power which transactions onshore successful a artifact and successful what order) tin seizure by inserting, reordering, oregon excluding transactions. It exists due to the fact that Ethereum’s mempool, wherever pending transactions hold to beryllium included, is publically disposable earlier it’s final. Anyone watching that mempool tin spot a ample pending commercialized and enactment connected the accusation earlier it settles.

A sandwich onslaught is MEV’s astir consumer-hostile form. When a trader submits a swap ample capable to determination a token’s terms connected a decentralized exchange, a bot detects it successful the mempool, submits its ain bargain bid instantly earlier the victim’s transaction (paying a higher state interest to warrant it lands first), lets the victim’s commercialized execute astatine the now-worse price, past instantly sells into the terms the victim’s ain commercialized pushed up.

The victim’s slippage tolerance (i.e., the maximum terms question they’ll accept) becomes the bot’s nett margin. No hack, nary exploit, nary astute declaration bug; it’s a axenic relation of transaction ordering, executed thousands of times a day.

MEV isn’t caller due to the fact that researchers were describing miners reordering transactions for nett arsenic aboriginal arsenic 2019, and the word itself was coined successful a 2019 world paper connected “miner extractable value.” What changed the crippled was Flashbots, a probe enactment founded successful 2020 that built the archetypal backstage auction strategy for MEV, aiming to propulsion the signifier retired of the nationalist mempool and into an orderly bidding process.

Ethereum’s assemblage nicknamed the pre-Flashbots mempool the “dark forest,” a spot wherever immoderate disposable transaction carrying worth could beryllium ambushed wrong seconds. MEV-Boost, launched alongside Ethereum’s 2022 transition to proof-of-stake, generalized that private-auction exemplary into the default mode blocks get built today.

The Machinery Behind Every Block

Sandwich bots don’t get to take artifact bid connected their own; they vie for it done MEV-Boost, the out-of-protocol auction strategy that much than 90% of Ethereum validators usage to outsource artifact construction. In MEV-Boost, specialized “builders” assemble afloat blocks and taxable bids to “relays,” which validate the blocks and guardant the highest bid to the validator scheduled to suggest next. The validator picks blind, seeing lone the bid amount, not the block’s contents, past signs whichever artifact pays the most.

That auction has consolidated into a tiny fig of hands. A unrecorded snapshot from relayscan.io, the Flashbots-run MEV-Boost monitor, shows relay.ultrasound.money handling 34.0% of payloads implicit a 24-hour window, Titan Relay 28.5%, and bloXroute’s regulated relay 25.0% (meaning three relays way astir 85% – 88% of each MEV-Boost blocks betwixt them).

Builder attraction is starker with Titan’s ain builder cognition assembling 50.3% of blocks outright, with Quasar and Buildernet each astir 16%. A azygous institution efficaciously decides transaction ordering for fractional of Ethereum’s blocks successful immoderate fixed window, the centralization hazard that critics of MEV-Boost person warned astir since its 2022 rollout.

In different words, a ascendant builder tin selectively include, exclude, oregon reorder transactions with small competitory check.

Sandwiches Are Shrinking But Not Fast Enough

Despite the eye-popping beingness numbers astir bots similar JaredfromSubway, determination is simply a metallic lining, arsenic the sandwich-attack system collectively has been softly deflating. Data drawn from a dataset of much than 95,000 attacks shows monthly sandwich extraction falling from astir $10 cardinal successful precocious 2024 to astir $2.5 cardinal successful October 2025, a 75% diminution successful nether a year.

Traders adopting MEV-protection tools (be it backstage RPCs oregon order-flow auctions that support pending trades retired of the nationalist mempool, which sandwich bots scan) get astir of the recognition for squeezing that margin.

That said, analysts still enactment trader losses to sandwich attacks astatine astir $60 cardinal a twelvemonth astatine the strategy’s peak, a fig artifact builders indirectly payment from too, since a ample stock of MEV nett yet flows to them arsenic the precedence fees bots wage to warrant their transactions onshore successful the close order.

Ethereum’s Roadmap Has a Structural Answer

From the extracurricular looking in, the enshrined proposer-builder separation (ePBS) module, which is portion of the planned Glamsterdam upgrade, volition determination today’s off-protocol MEV-Boost auction into the network’s statement rules, removing relays arsenic trusted middlemen and giving validators cryptographic guarantees astir artifact contented without needing to spot a builder oregon relay operator.

However, until that upgrade ships and makes its mode onto the market, the honorable summary of Ethereum’s MEV scenery is inactive 1 of looming uncertainty.