MEV Bot Developer JaredFromSubway Loses $15M to Hacker Attack on June 21

According to Blockaid, a MEV bot operated by developer JaredFromSubway.eth was compromised on June 21, draining approximately $15 million in assets including WETH, USDC, and USDT.

The attacker exploited a flaw in the bot's auto-execution mechanism by creating fraudulent token wrappers and liquidity pools. These constructs induced the bot to grant token approvals to attacker-controlled contracts. The attacker then utilized unrevoked approvals to transfer assets via transferFrom calls. Blockaid noted this was not a traditional phishing attack or smart contract vulnerability, but rather an exploitation of the bot's automated authorization issuance process.