JaredFromSubway MEV bot drained of about US$7.5 million through fake token approvals; funds not recovered
Ethereum MEV bot JaredFromSubway.eth lost about US$7.5M on 20 June 2026 after fake token contracts tricked it into granting spending approvals. The money went to Tornado Cash and none is reported recovered. Nothing for families to do.
Nothing for you to do: this hit one professional trading bot, not household accounts or devices. Anyone running an automated on-chain trading bot should limit and regularly revoke token approvals it grants.
What’s happening
On 20 June 2026, the Ethereum trading bot known as JaredFromSubway.eth was drained of about US$7.5 million in WETH, USDC and USDT in one transaction. Over several weeks, an attacker had deployed counterfeit token contracts and fake liquidity pools that looked like profitable trades. Reports agree on 66 contracts; CertiK says 131 were deployed and 66 were triggered. The bot approved these contracts to spend its real tokens and never revoked the unused approvals, so the attacker could collect them all at once. Blockaid said it was not phishing, a stolen key or a flaw in a common protocol. The attacker swapped the proceeds into roughly 4,400 ETH and sent a large part into Tornado Cash, an amount reported as between 1,000 and 3,000 ETH. Chainalysis stated on 26 June that no funds had been recovered, and no attacker has been identified. Sources differ on the operator's response: Crypto Briefing reported a half-the-funds offer with a 48-hour deadline, while The Block could not verify any operator statement. As of the latest coverage found, there is no fix to apply, no recovery and no arrest.
- What
- Breach
- Affects
- JaredFromSubway.eth Ethereum MEV trading bot
- Fixed in
- Nothing to patch
- Since
- 20 June 2026
- Closed
- 26 June 2026
Timeline
- Update
Chainalysis traced the laundering from stablecoin swaps into ETH, through split wallets, to Tornado Cash, and stated that no funds had been recovered and the attacker was unknown.
- Update
CertiK published its analysis: 131 bait contracts were deployed, 66 were triggered at activation and 60 held bot approvals. The bot approved them for wrapping operations without checking the allowances were used or revoking them. It counted 3,000 ETH deposited into Tornado Cash and about $2.44 million in DAI left in one wallet.
- Update
Crypto Briefing reported about 2,000 ETH routed through Tornado Cash and 1,422 ETH swapped for about 2.45 million DAI. It also reported an on-chain message from the operator offering half the funds (about 2,150 ETH) for the rest back within 48 hours, with an implied legal threat. The Block, by contrast, could not verify any operator statement, and flagged a claimed $1 million bounty account as likely an impersonator. No funds had been returned.
- Update
The Block reported the loss at roughly $7.5 million. Blockaid said it was not phishing, a stolen key or a flaw in a widely used protocol: attacker contracts induced the bot to grant approvals that were later abused. The attacker swapped the proceeds into about 4,427 ETH and moved 1,000 ETH into Tornado Cash.
- Made publicNothing to patch
On-chain data shows a single transaction sweeping about 1,474.58 WETH, 2.87 million USDC and roughly 2 million USDT from the JaredFromSubway MEV bot, after the attacker had deployed 66 counterfeit token contracts over several weeks.
Sources
- Notorious 'jaredfromsubway' MEV bot drained for roughly $7.5 million in counter-MEV honeypotThe Block · 21 June 2026
- JaredFromSubway MEV bot Incident AnalysisCertiK · 25 June 2026
- Sandwich Attack: How JaredfromSubway Lost $7.5MChainalysis · 26 June 2026
- Jaredfromsubway.eth exploiter launders 2,000 ETH through Tornado Cash as stolen funds keep movingCrypto Briefing · 23 June 2026