Security firm Blockaid confirmed the loss, which was denominated in WETH, USDC, and USDT. On-chain data shows the attacker subsequently converted the stolen assets into roughly 4,400 ETH and had already moved at least 1,000 ETH through Tornado Cash, the cryptocurrency mixing protocol, by the time the incident was widely reported.

How the Attack Worked

The attacker deployed 66 counterfeit token contracts designed to closely resemble WETH, USDC, and USDT. Each fake token was paired with a fraudulent liquidity pool engineered to look like a profitable sandwich opportunity. When the bot detected these setups and moved to exploit them, it followed its standard operating procedure: it granted token approvals to what it believed were legitimate helper contracts. Those contracts were actually attacker-controlled. Once the approvals were in place, the attacker called the standard transferFrom function to drain the bot's treasury.

Blockaid CTO Raz Niv described the mechanics plainly: "This was a counter-MEV honeypot attack, as it specifically targeted the automated, trust-minimized decision-making logic that MEV bots utilize." He added that the bot's own behavior sealed its fate. "Ironically, in the process, it provided the attacker the keys to millions in the bot's treasury."

Blockaid confirmed that no smart-contract bug, no phishing attempt, and no private-key compromise was involved. The attack worked entirely by exploiting how the bot makes decisions, not by breaking any underlying code.

Who Is Jaredfromsubway.eth?

The pseudonymous operator behind jaredfromsubway.eth (a name referencing Jared Fogle, the former Subway restaurant spokesman) has run what researchers have documented as the dominant sandwich attack bot on Ethereum since early 2023. A sandwich attack works as follows: the bot spots a pending trade in Ethereum's public mempool, buys the same token just ahead of it to push the price up, then sells immediately after the victim's trade executes at the inflated price. The victim pays more and receives less. The bot pockets the difference.

Between November 2024 and October 2025, jaredfromsubway.eth was executing between 60,000 and 90,000 sandwich attacks per month and accounted for roughly 70 percent of all Ethereum sandwich activity. Gross revenues over peak three-month windows were estimated at $34 to $40 million, with net profits above $6 million after gas costs. The bot has been attributed with more than 238,000 sandwich attacks affecting over 100,000 individual traders. In May 2026, it even sandwiched a transaction by Ethereum co-founder Vitalik Buterin, deploying over $1.14 million in WETH volume to net an estimated $2 to $4 in profit.

An X (formerly Twitter) account using the bot's name posted claims of a $15 million loss and offered a $1 million bounty for the return of funds. The Block assessed that account as a likely impersonator. On-chain data and Blockaid's forensic analysis both support the $7.5 million figure.

Why This Matters Outside the US

Sandwich attacks function as an invisible tax on DeFi participation. Ethereum traders collectively lose an estimated $60 million per year to this practice, and the burden falls hardest on retail users without access to MEV-protection tools like Flashbots Protect or MEV Blocker. India ranks among the top five countries globally for DeFi adoption, while Nigeria and Kenya both appear in the Chainalysis Global Crypto Adoption Index top 20. Users in all three regions are disproportionately exposed. Standard slippage settings, smaller trade sizes, and limited awareness of private mempool routing options all increase vulnerability.

The fake contracts in this incident mimicked WETH, USDC, and USDT. USDC and USDT, the two stablecoins among those three assets, dominate on-chain activity in Africa and South Asia, which makes the attack's asset selection particularly relevant to retail users in those regions. That detail is relevant beyond the immediate incident: it shows that approval-based exploits are now being crafted to target automated systems, not just human wallets. Developers building on EVM-compatible chains in emerging markets should take note of how the attack was structured.

One additional risk worth flagging for regional audiences: the unverified bounty claim circulating on X follows a pattern of social media impersonation that spreads quickly through Telegram and WhatsApp communities in South Asia and Africa. Any claim of losses or recovery bounties tied to this incident should be verified against Etherscan data and Blockaid's published findings before being acted on.

What Comes Next

The use of Tornado Cash to launder the stolen ETH reactivates a familiar regulatory question in jurisdictions where crypto anti-money-laundering frameworks are still taking shape, including India and South Africa. Tornado Cash carries particular legal weight because the U.S. Treasury's Office of Foreign Assets Control (OFAC) sanctioned the protocol in 2022, designating it as a tool for illicit finance. That designation makes its use here significant not only as a laundering tactic but as a compliance and enforcement concern for regulators across multiple jurisdictions, including those still building out their own crypto oversight regimes. Whether jaredfromsubway.eth resumes operations after this loss is unclear. If the incident leads to a sustained reduction in the bot's sandwich attack volume, retail DeFi traders on Ethereum would see a marginal improvement in execution quality. As of May 2026, total MEV extraction on Ethereum has crossed $1.2 billion, with sandwich attacks accounting for 51 percent of that figure. The structural problem is far larger than any single operator.