Ethereum MEV Bot JaredFromSubway Drained in Token Approval Exploit
The Ethereum MEV bot JaredFromSubway lost $7.5 million in a sophisticated exploit via malicious transaction approval traps, according to security firm Blockaid. The attack exposed vulnerabilities in the bot's router contract and unlimited token approval grants.
Written by CoinArticle’s AI Newsroom · from 3 cited sources. How we work
Story Updates
- Updated Sep 26, 2026, 06:30 AM: Blockaid confirmed $7.5M loss and provided technical details on the router contract vulnerability and approval trap mechanism.
How the Attack Unfolded
The MEV bot JaredFromSubway was drained through malicious token approvals embedded in a transaction approval trap, according to security analysis by Blockaid. The exploit leveraged a vulnerability in the bot's router contract, allowing an attacker to withdraw assets held in the contract after tricking the bot into signing a malicious approval.
Loss Confirmation and Technical Details
Blockaid confirmed the total loss at $7.5 million in the exploit. The firm detailed how the transaction approval trap worked as a counter-MEV mechanism — essentially a honeypot designed to catch the bot attempting to extract value from transactions. Earlier reports citing figures as high as $15 million likely reflected different valuation snapshots of the bot's holdings at the time of compromise.
Implications for Bot Security
The incident highlights a critical vulnerability in MEV bot architecture: unlimited token approvals granted to contracts can be weaponized through social engineering or contract exploitation. JaredFromSubway was one of the most active MEV bots on Ethereum, making it a high-value target. The compromise demonstrates that even sophisticated operators remain exposed to approval-based attacks and honeypot mechanisms designed to drain router contracts.
Why It Matters
For Traders
MEV bot compromise raises immediate questions about counterparty risk in bot-executed strategies; traders using similar infrastructure should audit token approval grants.
For Investors
The attack demonstrates that sophisticated MEV operators remain structurally vulnerable to approval-based social engineering, a persistent risk in current DeFi tooling.
For Builders
Contract developers should implement approval limits, timelocks on permission changes, and honeypot detection patterns to harden router and bot infrastructure.
This article is for information only and is not financial advice. Read the full disclaimer.
