JaredfromSubway.eth Sandwich Bot Drained of at Least $7.5 Million
Summary
An unknown attacker reportedly used 66 fake token contracts and unrevoked spending approvals to steal at least $7.5 million from JaredfromSubway.eth, then converted the assets to ETH and sent them through Tornado Cash.
Key points
- The attack occurred on Ethereum on June 20–21, 2026, and drained at least $7.5 million in ETH and stablecoins.
- The attacker deployed 66 fake token contracts and paired them with fraudulent liquidity pools to attract the bot.
- The bot granted token-spending approvals to the malicious contracts; the permissions were not revoked or used until the attacker triggered a coordinated transaction to sweep its assets.
- The attacker converted the stolen stablecoins to ETH, split the funds across wallets, and moved them into Tornado Cash. No funds have been recovered.
- The article recommends revoking unused token approvals and checking smart-contract verification, deployment history, and pool track records before interacting.
Article Details
- Victim Organization
- JaredfromSubway.eth
- Incident Type
- Reverse honeypot exploit involving fake token contracts and unrevoked token-spending approvals
- Incident Date
- 2026-06-20
- Affected Data Size
- At least $7.5 million in ETH and stablecoins
- Operational Impact
- The bot's wallets were drained of approximately $7.5 million. No funds had been recovered, according to the article.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
Products
EthereumJaredfromSubway.eth, the most prolific sandwich-attack bot on Ethereum, was drained of at least $7.5 million in a reverse honeypot exploit on June 20–21, 2026.Tornado CashThe stolen funds — ETH and stablecoins — were converted to ETH and sent to Tornado Cash.USDCAn unknown attacker deployed 66 fake token contracts that mimicked legitimate assets like WETH, USDC, and USDT, and paired them with fraudulent liquidity pools. To Jared’s bot, these looked like easy sandwich targets.USDTAn unknown attacker deployed 66 fake token contracts that mimicked legitimate assets like WETH, USDC, and USDT, and paired them with fraudulent liquidity pools. To Jared’s bot, these looked like easy sandwich targets.WETHAn unknown attacker deployed 66 fake token contracts that mimicked legitimate assets like WETH, USDC, and USDT, and paired them with fraudulent liquidity pools. To Jared’s bot, these looked like easy sandwich targets.