The attacker behind the June 20 exploit of Ethereum MEV bot Jaredfromsubway has moved 2,000 ETH (worth about $3.4 million) through Tornado Cash, ignoring a 50% bounty offer from the bot's operator. The transfer signals that the hacker may have little interest in negotiating, despite public appeals and a time-sensitive reward.
How the Exploit Unfolded
The attack, analyzed by blockchain security firms Peckshield and Blockaid, netted 1,474 WETH, 2.87 million USDC, and 2 million USDT without breaking any code. The perpetrator created fake wrapper tokens — fWETH, fUSDC, and fUSDT — paired with counterfeit liquidity pools that appeared as profitable MEV opportunities to the bot's automated scanning system.
Once the bot granted token approvals to the attacker's helper contracts, the exploiter crafted routes where approvals were never revoked, building up spending rights over the bot's holdings. When ready, the attacker's contract used standard transferFrom calls to drain the funds. Crypto researcher RaFi called it a "masterclass in social engineering on-chain."
Bounty Offer and Response
The bot operator first offered a $1 million reward, later raising it to $3 million in a "time-sensitive" bounty with promises of confidentiality. When no response came, an on-chain message offered to accept 2,150 ETH (about 50% of the haul) and gave the hacker 48 hours to comply, threatening legal action.
Instead of returning funds, the attacker moved 2,000 ETH through Tornado Cash and sold 1,422 ETH for roughly $2.4 million in DAI, leaving only 5 ETH in their wallet. The bot operator later said a self-described white-hat group had made contact, but no agreement was confirmed.