Ethereum sandwich bot falls to honeypot, losing $7.5M

An Ethereum sandwich bot, identified as JaredfromSubway.eth, reportedly lost at least $7.5 million to a honeypot exploit on June 20–21, 2026. Chainalysis says the attacker deployed 66 fake token contracts that mimicked legitimate assets. The bot continued its usual fast workflow—granting token-spending approvals that were never revoked—then interacted with the trap until a tripwire contract swept the bot’s real balances in one transaction. Chainalysis traced the stolen funds as the attacker split holdings across multiple wallets and eventually funneled them into Tornado Cash. As of the report, no funds were recovered. The incident highlights two key security failures: unrevoked token approvals can remain active indefinitely, and the sandwich bot never properly vetted the contracts it interacted with (a basic check via Etherscan deployment history could have flagged the fake contracts). For traders, this underscores that MEV-style sandwich bot activity is not only a DeFi risk-management issue but also an operational threat to bot operators and liquidity. It may also temporarily increase caution around token approvals, pool interactions, and contract vetting—especially during periods of high mempool activity.