JaredFromSubway.eth MEV Bot - Counter-Honeypot Exploit
Summary
JaredFromSubway.eth is a pseudonymously operated Ethereum MEV (Maximal Extractable Value) sandwich-attack bot that rose to infamy in 2023 and became responsible for an estimated 70% of all sandwich attacks on the Ethereum network between November 2024 and October 2025. On June 20, 2026, an unknown attacker reversed the bot's predatory logic against it, deploying 66 fake token contracts and fake liquidity pools to manipulate the bot into granting persistent token spending approvals, then sweeping approximately $7.5 million in WETH, USDC, and USDT in a single coordinated drain transaction. The stolen funds were subsequently routed through Tornado Cash, and the bot's operator — who offered a 50% white-hat bounty — has alleged they will pursue legal and law-enforcement remedies.
Connected Entities
1 entities · 10 linked investigationsTimeline(9 events)
2023-04-18
Bot generates over $2 million in profit from 24,000+ sandwich attacks in two days during the PEPE memecoin trading frenzy, using $100 million in daily PEPE volume.
DL News2023-06-01
Bot reported to appear in over 60% of all Ethereum blocks at peak operational intensity, executing millions of transactions.
The Block2024-04-03
Bot records one of its best single trading days, generating approximately $300,000 in profits by targeting Ethena (ENA) token traders on the day of ENA's airdrop launch, with $14.8 million in ENA volume processed.
DL News2024-08-14
Operator allegedly deploys a new contract address ('Jared 2.0'), deprecating the original. The new address, created by the same key pair, begins executing more sophisticated multi-layer sandwich attacks.
The Block2026-04-30
Bot sandwich-attacks Ethereum co-founder Vitalik Buterin's swap of 26,544 XDB tokens for ETH, deploying $1.14 million in WETH to manipulate prices across SushiSwap and Uniswap V2. The bot fails to profit after gas fees.
CoinDesk2026-06-20
Unknown attacker executes counter-honeypot exploit across approximately 97 blocks using 66 fake token contracts and fabricated liquidity pools, draining approximately $7.5 million (1,475 WETH, $2.9M USDC, $2M USDT) from the bot in a single coordinated drain transaction.
CoinDesk / Blockaid / Protos2026-06-22
Bot operator posts on-chain message offering a 50% white-hat bounty (approximately 2,150 ETH, roughly $3.7 million) for return of stolen funds within 48 hours, threatening legal and law-enforcement action otherwise.
Decrypt2026-06-24
Attacker ignores bounty deadline and routes approximately $5.1 million of stolen funds through Tornado Cash in 20 uniform 100-ETH transactions. Remaining approximately 1,422 ETH is converted to DAI stablecoin.
AMBCrypto / The Currency AnalyticsDecision Log
- hash: AgXpSKL6MCWwoxFWcfzonnXgXaUunak65LMLU2VSHTLf
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 7/1/2026, 12:05:16 PM
last updated: 7/1/2026, 12:05:26 PM
avoid.net — verified advice for a post-truth world