According to MarsBit, the well-known Ethereum MEV bot address Jaredfromsubway.eth was hit by a targeted “anti-MEV honeypot attack,” resulting in losses of more than $7.5 million. The address, known for using automated trading strategies to capture on-chain transaction opportunities, became the target of a setup in which the hunter was effectively hunted.
66 fake contracts used to trigger automated execution
The attacker deployed 66 fake contracts and liquidity pools that were disguised as mainstream assets. These contracts and pools were used to lure the bot into automatically executing trades. During the process, the bot was induced to grant permissions, after which the attacker used contract backdoors to steal assets.
The incident centered on the bot’s automated behavior logic, including recognition, trade execution and approval flows, rather than a simple private-key compromise narrative. It shows that even top-tier MEV robots can face security risks when confronted with customized contracts, disguised liquidity pools and permission traps. For automated on-chain strategies, asset identity, contract source, approval scope and trade-trigger conditions all fall within the scope of security checks, while high-frequency execution capability can also be turned against the bot by an attacker.