Attackers used fake markets to turn Jaredfromsubway.eth’s trading approvals into a $7.5 million allowance drain.The Jaredfromsubway MEV bot, linked to roughly 70% of Ethereum sandwich attacks, lost more than $7.5 million in an allowance drain after its automated system authorized attacker-controlled contracts to spend its tokens.
The bot, known as Jaredfromsubway.eth, approved a series of transactions that appeared to be part of profitable trading routes. Those permissions remained active, allowing the attacker to remove wrapped ether and two major stablecoins from contracts associated with the operation.
The incident effectively caused one of Ethereum’s largest extractive trading systems to approve its own theft. It also highlights a vulnerability facing automated traders that must evaluate markets, authorize contracts, and execute transactions within seconds.Onchain security company Blockaid said the attacker did not compromise the bot’s private keys or exploit a flaw in a widely used decentralized finance protocol. Instead, the operation targeted the rules the bot used to identify and pursue potential profits.How Jaredfromsubway.eth was drained
According to Blockaid, the attacker had spent several weeks deploying imitation tokens, liquidity pools, and supporting contracts that resembled markets the bot might normally trade against.
The fake assets included versions of wrapped Ethereum, USDC, and USDT, paired via trading routes designed to generate profitable-looking signals. Jaredfromsubway.eth detected those routes and followed its usual process of permitting helper contracts to move tokens as part of the expected trades.
Some early transactions used the permissions as anticipated, helping establish a pattern that the bot’s system continued to accept. Later transactions left the approvals unused.That distinction gave the attacker an opening through ERC-20 approvals, which allow another address or smart contract to spend a specified amount of tokens belonging to the approving account.
The permission can remain available after the original transaction unless it is exhausted, reduced, or revoked.
Once the attacker had accumulated enough unspent allowances, the contracts used the ERC-20
transferFrom function to move real WETH, USDC, and USDT from the bot’s accounts.On-chain records show repeated transfers totaling about 92 WETH, $143,000 USDC, and $149,000 USDT from a contract linked to the bot. The funds were directed to an address controlled by the attacker.