JaredFromSubway MEV Bot — Counter-MEV Honeypot Approval Drain

Timeline: T-X (weeks prior to June 20, 2026): Attacker deploys and seasons 66 fake token wrapper contracts and sham liquidity pools designed to look like profitable arbitrage opportunities, specifically targeting the automated, trust-minimized decision logic used by MEV bots. T0 (June 20, 2026, ~18:49 UTC): The bot's automated strategy interacts with the bait contracts and grants token approvals to attacker helper contract 0xE93e8AA4e88359dACf33c491Cf5bD56eB6C110c1. T+minutes: Attacker sweeps WETH, USDC and USDT from the bot via transferFrom calls, consolidating into 0x3e37f4A10d771Ba9dE44b6d301410b1BEdeA65d0 and downstream addresses. T+same day: Analyst Specter and Blockaid publicly flag the drain on X (June 20, 2026); PeckShieldAlert confirms the approval-hijack vector. T+2 days (June 22, 2026): The bot operator posts an on-chain message offering 50% of the stolen assets (~2,150 ETH) for return within 48 hours; the attacker declines. The Block reports ~2,000 ETH routed through Tornado Cash the same day. T+2-3 days: ~1,422 ETH swapped for ~$2.45M DAI via DEX (CryptoPotato, Crypto Briefing, June 22-23). Status as of report compilation: Active/unrecovered, no attribution to any named threat actor by any authoritative security firm.