According to BlockAid, famous Ethereum sandwich bot Jarezy MEV lost $7.5 million in digital assets on June 21, after attackers exploited its mechanism to gain spending approval. The attackers created fake tokens and liquidity pools that appeared profitable to the bot, tricking it into approving a helper contract as a spender to withdraw funds.
Once granted permissions, the attackers gradually transferred approximately 92.16 WETH and other assets to their wallet through carefully constructed transaction routes. Unlike traditional phishing attacks or smart contract exploits, this attack leveraged the bot's automated profit-seeking mechanism against itself.