On June 20th, Jaredfromsubway.eth was attacked by the associated MEV robot, at a loss of approximately $7.5 million. The attackers first create a counterfeit token packaging and mobility pool, then rewrite the trade logic and induce the robot to automatically complete the authorization.
How the money was transferred.
In this attack, the attackers took 1,583 ETH, 2.87 million USDC and 2.09 million USDT. Subsequently, the assets were consolidated and replaced with 4,427 ETH to facilitate subsequent transfer.
- Multiple 100 ETH transfers then entered Tornado Cash
- A single amount of approximately US$ 172,000
- At least 1,000 ETH has gone to the Mixer
Risk is not in the code itself.
According to the article, the incident revealed not just an intelligent contractual gap, but the authorization process itself. The attackers used the privileges in the robot workflow, not simply looking for code errors.
As the use of MEV robots in the Ether, Solana and Layer 2 networks expands, the management of privileges is becoming a more prominent security issue for DeFi. According to the article, the more funds are concentrated in automated implementation systems, the higher the risk of operational errors and abuse of authority.