Tools Crypto Exploit Tracker exploit-0029
Exploit record
JaredFromSubway MEV Bot
- Loss
- $8M
- Attack vector
- Phishing
- Chain
- Ethereum
- Sector
- Infrastructure
What happened
On 20 June 2026 the notorious jaredfromsubway.eth MEV bot was drained of roughly $7.5 million in WETH, USDC and USDT by a counter-MEV honeypot (some outlets put the figure as high as $15 million).
The attacker deployed 66 fake token contracts and rigged liquidity pools that looked like profitable trades; when the bot took the bait it granted token approvals to attacker-controlled contracts, and those dangling approvals were later used to sweep the bot's holdings in a single coordinated transaction. Blockaid had flagged the attacker's wallets and contracts as malicious before the final drain, and Chainalysis documented the incident as the most prominent case of a predator bot being drained by its own logic.
Sources
One record from the Crypto Exploit Tracker, maintained by the Security Desk. Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 15 September 2026