Trust Is the Attack Surface

And this week, we're looking at one of the most ironic stories in crypto security.

If you've spent any time on Ethereum, you've probably heard the name Jared from Subway.

Jared from Subway is associated with one of Ethereum's most notorious MEV operations, generating profits through sandwich attacks.

These bots monitor pending transactions, jump ahead of users, trades, and then sell afterwards to capture the price movement.

For years, these bots have extracted millions from unsuspecting traders.

But this week, the hunter became the hunted.

According to blockchain security researchers, an attacker managed to exploit the Jared from Subway bot itself, reportedly draining somewhere between $7.5 to $15 million worth of crypto assets.

What's interesting is how the attack happened.

The attacker didn't steal a private key.

They didn't exploit a smart contract vulnerability.

Instead, they weaponized the bot's own automation against it.

Researchers say the attacker created dozens of fake tokens and liquidity pools that appeared profitable to the bot.

The bot interacted with those contractors and unknowingly granted token approvals that should never have been approved.

Once those approvals existed, the attacker simply came back later and used them to drain funds.

And think about that for a moment.

One of the most sophisticated automated systems in crypto wasn't defeated by brute force.

It was defeated by deception.

The bot saw what looked like profit and acted exactly as it was programmed to act.

The attacker understood that behavior and turned it into a weapon.

Many people believe automation removes risk.

In reality, automation often changes risk.

The more authority you give a system, the more damage it can cause when something goes wrong.

Whether it's an MEV bot, a trading bot, an AI agent, or a smart contract, every automated decision creates a potential attack surface.

As AI agents become more common in crypto, this lesson becomes even more important.

your software can sign transactions approve tokens move funds or execute trades automatically then attackers will eventually look for ways to manipulate logic behind those actions and before you trust any automated system with your money ask yourself this what happens if this system is wrong what permissions does it have and what could an attacker do if they figured out how it thinks Because sometimes the biggest vulnerability isn't the code, it's the assumptions the code was built on.

And this week, we're looking at one of the most ironic stories in crypto security.

If you've spent any time on Ethereum, you've probably heard the name Jared from Subway.

Jared from Subway is associated with one of Ethereum's most notorious MEV operations, generating profits through sandwich attacks.

These bots monitor pending transactions, jump ahead of users, trades, and then sell afterwards to capture the price movement.

For years, these bots have extracted millions from unsuspecting traders.

But this week, the hunter became the hunted.

According to blockchain security researchers, an attacker managed to exploit the Jared from Subway bot itself, reportedly draining somewhere between $7.5 to $15 million worth of crypto assets.

What's interesting is how the attack happened.

The attacker didn't steal a private key.

They didn't exploit a smart contract vulnerability.

Instead, they weaponized the bot's own automation against it.

Researchers say the attacker created dozens of fake tokens and liquidity pools that appeared profitable to the bot.

The bot interacted with those contractors and unknowingly granted token approvals that should never have been approved.

Once those approvals existed, the attacker simply came back later and used them to drain funds.

And think about that for a moment.

One of the most sophisticated automated systems in crypto wasn't defeated by brute force.

It was defeated by deception.

The bot saw what looked like profit and acted exactly as it was programmed to act.

The attacker understood that behavior and turned it into a weapon.

Many people believe automation removes risk.

In reality, automation often changes risk.

The more authority you give a system, the more damage it can cause when something goes wrong.

Whether it's an MEV bot, a trading bot, an AI agent, or a smart contract, every automated decision creates a potential attack surface.

As AI agents become more common in crypto, this lesson becomes even more important.

your software can sign transactions approve tokens move funds or execute trades automatically then attackers will eventually look for ways to manipulate logic behind those actions and before you trust any automated system with your money ask yourself this what happens if this system is wrong what permissions does it have and what could an attacker do if they figured out how it thinks Because sometimes the biggest vulnerability isn't the code, it's the assumptions the code was built on.