On June 20, the Jaredfromsubway.eth-related MEV bots were attacked, resulting in a loss of approximately $7.5 million. The attackers first created counterfeit token wrappers and liquidity pools, then rewrote the trading logic to trick the bots into automatically completing authorizations.
How were the funds transferred?
In this attack, the attackers stole 1,583 ETH, 2.87 million USDC, and 2.09 million USDT. These assets were then consolidated and exchanged for 4,427 ETH for subsequent transfer.
- Multiple transfers of 100 ETH each subsequently went into Tornado Cash.
- The single transaction amount was approximately US$172,000.
- At least 1,000 ETH have flowed into the mixer.
The risk is not in the code itself.
The article points out that this incident exposed not only smart contract vulnerabilities, but also the authorization process itself. The attackers exploited permissions within the bot workflow, rather than simply searching for code errors.
As the use of MEV bots expands across Ethereum, Solana, and Layer 2 networks, access control is becoming a more prominent security issue in DeFi. The article argues that the more funds are concentrated in automated execution systems, the higher the risks of operational errors and access abuse.
