jaredfromsubway.eth Drain via Fake Route Approvals

The incident concerned jaredfromsubway.eth, an Ethereum MEV bot known for sandwich trading, which CoinDesk reported was drained for more than $7.5 million on 2026-06-21.^[1] The available record described the event not as a standard smart-contract bug and not as a conventional phishing episode, but as an exploitation of the bot’s own automated trading logic.^[6] In the present dossier, the central mechanism was the generation of token approvals under false routing assumptions, creating a path by which attacker-controlled contracts could later move assets from the bot’s control.^[2][3]

According to CoinDesk’s account, the setup was not instantaneous. The reporting stated that the attacker built the environment over several weeks by deploying dozens of fake token contracts and fake liquidity pools.^[4] That preparatory stage matters because the reported exploit depended on the bot encountering infrastructure that appeared sufficient to support trading logic, even though the underlying routes were attacker-fabricated.^[2][4] On the present record, this was therefore less a case of unauthorized code execution than a case in which the system’s own execution path was induced to treat malicious route data as legitimate trading context.^[2][6]

Blockaid, as cited by CoinDesk, said the attacker tricked the bot into approving fake trading routes.^[2] The timeline in the brief further stated that these interactions generated approvals for attacker-controlled helper contracts to spend tokens on the bot’s behalf.^[2] Within Ethereum token standards, approvals are operationally significant because they can persist beyond the immediate transaction that created them; in this case, the reported exploit path turned those permissions into the decisive control point.^[2][6] The dossier therefore supports a mechanism in which the compromise arose from permissioning under deceptive market structure rather than from a direct break of cryptographic controls or a disclosed flaw in token contracts themselves.^[2][4][6]

Once those approvals existed, the attacker reportedly used them to transfer WETH, USDC, and USDT out of the bot’s contracts.^[3] CoinDesk’s reporting, as reflected in the brief, identified these assets specifically and tied the drain to the previously obtained open approvals rather than to a separate exploit stage.^[3] The sequence presented in the dossier was therefore linear: fake route environment, induced approvals, then token transfers using those permissions.^[2][3][4] That sequence is important because it narrows the principal failure mode to authorization logic and route validation, not merely to post-compromise fund movement.^[2][6]

The available reporting also stated that some of the stolen funds were later sent to Tornado Cash.^[5] In the present record, that point served as a documented observation about subsequent fund routing, not as proof of final disposition, recovery impossibility, or attacker identity.^[5] No transaction hashes, contract addresses, or complete asset-by-asset movement map were included in the dossier, so the public reconstruction remained high level even where the broad path was described.^[5] As of 2026-06-21, the established narrative was therefore one of a completed drain with at least some proceeds moved into a mixing service, while the fuller transactional topology remained outside the supplied evidence base.^[1][5]

The documented consequences were material but narrowly evidenced. CoinDesk reported losses of more than $7.5 million from jaredfromsubway.eth.^[1] The assets named in the drain were WETH, USDC, and USDT, and some portion of the proceeds was later routed through Tornado Cash according to on-chain data reviewed by CoinDesk.^[3][5] The dossier did not identify affected users, did not describe any court action or regulatory proceeding, and did not state that any funds had been recovered as of 2026-06-21.^[1][5]