TLDR Tech / Crypto
MEV Bot Exploited for $15M via Fake-Token Route Attack
MEV bot jaredfromsubway was exploited for over $15 million in a targeted onchain attack that exposed a blind spot in how MEV bots evaluate transaction routes. The attacker deployed counterfeit token contracts (fake fWETH and fCAP), minted them, routed them through trading pairs, and induced the bot to approve real WETH from the canonical WETH contract to the fake wrapper addresses. MEV bots are optimized to verify route profitability, execution math, and frontrun resistance, but not to authenticate whether tokens in a route are genuine, a gap the attacker targeted. The attack's specificity suggests the attacker pre-tested or reverse-engineered the bot's evaluation logic, establishing a new attack class that targets MEV infrastructure assumptions rather than contract-level vulnerabilities.
Read the full story