JaredFromSubway MEV Bot Drained of $15 Million After Malicious Token Approvals
Summary
An attacker reportedly tricked the JaredFromSubway Ethereum MEV bot into approving helper contracts, then used accumulated token permissions to drain WETH, USDC, and USDT worth $15 million. Recovery negotiations are ongoing.
Key points
- The JaredFromSubway Ethereum MEV bot suffered a reported $15 million loss.
- Blockaid detected the drain; JaredFromSubway confirmed the attacker used fake pools and tokens to manipulate the bot’s opportunity-detection logic.
- The bot granted ERC-20 spending approvals to attacker-controlled helper contracts.
- The attacker accumulated approvals, including up to 92.1614 WETH, before using transferFrom to withdraw WETH, USDC, and USDT.
- JaredFromSubway offered escalating bounties and is negotiating with a white-hat group, but no recovery deal was confirmed.
Article Details
- Victim Organization
- JaredFromSubway
- Incident Type
- Cryptocurrency theft through manipulation of MEV opportunity-detection logic and misuse of ERC-20 token approvals
- Operational Impact
- Approximately $15 million in WETH, USDC, and USDT was drained from the JaredFromSubway MEV bot contract.
- Ransom Or Extortion
- JaredFromSubway offered an initial $3 million bounty for the full return of the stolen funds, then increased the offer to $7.5 million for the return of 50%. It was also negotiating with a white-hat hacking group; no deal was confirmed.
- Claim Status
- confirmed