The Predator Becomes the Prey: Ethereum's Most Notorious Bot Loses $7.5 Million

For two years, an automated trading bot known by its on-chain name “jaredfromsubway.eth” was the boogeyman of Ethereum. It earned a fortune skimming pennies and dollars off other people’s trades. Now it has been outsmarted, drained of roughly $7.5 million in an attack so fitting that researchers are calling it “counter-MEV.” Here is what happened, and why retail crypto traders should pay attention.

What a “sandwich bot” actually does
Sandwich bots are a form of MEV, or maximal extractable value. When you submit a trade on a decentralized exchange, it sits briefly in a public waiting room before it settles. A sandwich bot spots your pending order, jumps in front of it to push the price up, lets your trade execute at the worse price, then sells right behind you. You get sandwiched, and the bot pockets the difference. jaredfromsubway was the biggest of them all, reportedly responsible for around 70% of Ethereum sandwich attacks that cost everyday traders an estimated $60 million a year.

How the bot got beaten
The attacker did not break a smart contract or steal a password. Instead, they exploited the bot’s own greed. Over several weeks, they set up fake tokens and liquidity pools that mimicked real assets like WETH, USDC and USDT. The bot, programmed to chase any profitable-looking trade automatically, kept approving these malicious helper contracts. In early tests the approvals were used and closed immediately. But the attacker patiently engineered later routes where those approvals stayed open, leaving them with standing permission to reach in and pull the funds. Some of the proceeds were then routed through the mixing service Tornado Cash.

Why traders are calling it ironic justice
The poetic detail making the rounds: this same bot once sandwiched a tiny swap made by Ethereum co-founder Vitalik Buterin, putting up more than a million dollars to front-run the trade and netting just a few dollars after fees. A machine built to prey on careless humans was ultimately undone by a human who understood exactly how the machine thinks. The honeypot turned the bot’s relentless pattern-matching into the weapon used against it.

The real lesson for everyday investors
This was not a victory for ordinary traders, and it does not make sandwich attacks go away. But it is a vivid reminder that “the code runs itself” is not the same as “the code is safe.” Any system that approves transactions at machine speed, based purely on profit signals, can be lured into a trap by someone who studies its behavior long enough. The same logic applies to the bots, scripts and auto-trading tools that retail investors increasingly rely on.

What it signals about crypto’s plumbing
Crypto markets are still a place where the infrastructure itself can be the trade. With Bitcoin hovering near $64,000 and sentiment fragile after the Fed’s hawkish turn, stories like this underline how much of the action happens in the wiring beneath the price charts. For most investors the takeaway is simple: understand where your money actually goes when you hit “swap,” and treat any tool that moves funds on your behalf with healthy suspicion.

This article is for informational and educational purposes only and is not investment advice. Cryptocurrencies are highly volatile and speculative, and you can lose your entire investment. Always do your own research and consult a licensed financial professional before making any decisions.