Blockaid describes the attack as an approval-based incident where attacker-controlled contracts manipulated the bot’s automatic MEV opportunity detection and approval process, rather than phishing, stolen keys, or a direct smart-contract flaw.

The vulnerability lay in the bot’s market-identification and authorization logic, not in the keys or widely used DeFi protocols.

Attackers exploited the bot’s mechanism for evaluating profitable MEV opportunities, rather than targeting a traditional phishing or standard smart-contract vulnerability.

Stolen assets included large tokens like WETH, USDC, and USDT, enabling subsequent fund movement and liquidation across Ethereum trading venues.

Final loss figures are evolving as more wallets and contracts are reviewed, reflecting the dynamic nature of on-chain investigations and attribution.

The incident involved Jaredfromsubway.eth, a prominent Ethereum MEV bot, with estimated losses around $7.5 million.

This event underscores the broader risks of industrialized sandwich-bot activity, which accounts for a large share of Ethereum sandwich attacks and substantial annual losses for traders.

Different trackers initially estimated about $7.5 million, later figures rose above $17 million due to ongoing tracing and new related transactions.

The exploit culminated in an “allowance drain,” using a withdrawal contract to sweep balances across dozens of subsidiary contracts.

Recovery hinges on whether the attacker accepts a bounty offer to return the funds.

Earlier, the bot targeted a Vitalik Buterin transaction, illustrating its willingness to chase small opportunities and highlighting MEV patterns across liquidity pools.

A final contract used open allowances to drain real funds, effectively turning the bot’s speed into a vulnerability via a reverse MEV trap.