Loading story…
An attacker stole between $7.5 million and $15 million from jaredfromsubway.eth, the Ethereum address associated with one of the network’s most active sandwich-attack bots, by exploiting the bot’s automated trading logic rather than a flaw in Ethereum itself. Researchers said the attacker spent weeks preparing the operation, deploying 66 fake token contracts and sham liquidity pools designed to resemble assets such as WETH, USDC, and USDT, then feeding the bot false trading opportunities that caused it to approve attacker-controlled helper contracts.
After testing the setup with earlier benign transactions, the attacker used the preserved token allowances to execute a sweep transaction and drain real assets with transferFrom, routing at least some of the proceeds through Tornado Cash while retaining the rest in attacker-controlled wallets. The incident has been described as a targeted operational failure of the bot, which had been linked to a large share of Ethereum sandwich attacks, and the operator reportedly responded by offering a bounty that rose from $3 million to $7.5 million in exchange for the partial or full return of the stolen funds while also pursuing talks with a white-hat group.
Track how attackers are adapting to this technology.
5 events from the most recent confirmed update back to the earliest known activity.
JaredFromSubway later increased the offer to $7.5 million in exchange for the return of half of the stolen amount, and was also reportedly negotiating with a white-hat hacking group.
Following the theft, JaredFromSubway reportedly offered the attacker a $3 million bounty in exchange for the full return of the stolen funds.
After the theft, some of the stolen cryptocurrency was reportedly sent through Tornado Cash, while the remainder stayed in attacker-controlled addresses.
Over the weekend, the attacker used previously obtained approvals to execute a sweep transaction that drained real WETH, USDC, and USDT from contracts controlled by the JaredFromSubway MEV bot. The reported loss was described as more than $7.5 million by one source and about $15 million by another.
According to Blockaid, the attacker spent several weeks deploying 66 fake token contracts and sham liquidity pools designed to mimic assets such as WETH, USDC, and USDT in order to manipulate the JaredFromSubway bot's automated approval logic.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
5 references tracked. Mallory keeps watching after this page renders.
chainalysis.com
Open sourcexakep.ru
Open sourcescworld.com
Open sourcethedefiant.io
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A cryptocurrency theft campaign used at least nine YouTube tutorials purporting to teach users how to create Claude-powered arbitrage bots. The videos directed viewers to counterfeit compiler websites styled after Remix, which silently substituted the displayed benign smart-contract code with Ethereum drainer code. From February 12 through August 11, 224 wallets deployed and funded 234 malicious contracts, sending **274.60 ETH**—about **$517,205** at the time of transfer—to six operator-controlled collection addresses. The fraud bypassed common wallet protections because victims themselves deployed the contracts and authorized the transfers, rather than signing conspicuous malicious approvals or interacting with phishing domains. Operators used AI-generated presenters and voices, near-identical scripts, fabricated testimonials, and fake error messages to make the tutorials credible and encourage additional deposits. TRM Labs traced stolen funds through decentralized swaps, cross-chain bridges, and at least one mixer; it found no centralized exchange in the observed outbound flow. Earlier versions of the scheme used ChatGPT branding, indicating a reusable AI-themed lure.
Sep 18, 2026
An exploit against the **Verus-Ethereum bridge** drained about **$11.58 million** in crypto assets, according to reports from Blockaid, PeckShield, and GoPlus. PeckShield said the attacker stole **103.6 tBTC, 1,625 ETH, and 147,000 USDC**, then swapped the proceeds into roughly **5,402 ETH**; the attacker wallet was reportedly seeded with **1 ETH from Tornado Cash**. Security researchers also identified attacker and destination wallets as the theft unfolded. Verus said its network was **halted**, with most block-producing nodes taking themselves offline after the attack’s effects appeared, while developers investigated the root cause and recovery options. GoPlus said the exploit may stem from **cross-chain message validation or signature forgery**, a **withdrawal logic bypass**, or an **access control flaw** in the bridge, which was launched to move assets between the privacy-focused Verus blockchain and Ethereum.
Jun 29, 2026
Drift Protocol, a Solana-based decentralized trading platform, said attackers stole about **$280 million to $285 million** after a months-long intrusion culminated in the takeover of administrative control and the draining of protocol vaults in roughly 12 minutes. Drift’s preliminary findings said the operation abused Solana’s **durable nonce** feature and pre-signed transactions rather than a simple smart contract flaw, while investigators reported that the attackers staged activity weeks in advance, created a fake asset called **CarbonVote Token (`CVT`)**, and manipulated its trading history so protocol oracles would accept it as collateral. The stolen assets were then swapped largely into **USDC** and **SOL**, bridged to Ethereum through Circle’s Cross-Chain Transfer Protocol, and moved onward through additional services and exchanges.
Jul 1, 2026