On 28 August 2020, two Paradigm researchers, Dan Robinson and Georgios Konstantopoulos, told how they had tried to rescue about 12,000 dollars of Uniswap liquidity tokens sent by mistake to the blockchain that runs exactly as written when it is called, holding and moving funds according to its code, without an intermediary able to change the outcome.">smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool contract, where anyone could claim them. Knowing that bots watch pending transactions, they split the rescue into two transactions meant to land in the same block. The second slipped into a later one, and by then a bot had copied the withdrawal and swept the tokens. Their account, titled “Ethereum is a Dark Forest”, closes the episode in five words: “The monsters had devoured us.”
MEV in crypto, short for maximal extractable value, is the profit available to whoever decides which transactions enter a block and in what order. The bot in that story hacked nothing. It read a public transaction, saw that the same call would pay whoever sent it first, and paid to be first. This lesson explains where that power comes from in consensus, how a market grew around it between 2019 and 2026, who holds it today, and why front-running and sandwich attacks end up on the bill of people who have never heard the word.
It follows on from our comparison of consensus mechanisms, which showed how chains agree on one history. Here the question is narrower and more uncomfortable: agreement on a block says nothing about whether its order was fair. If you want the practical side, how to protect a swap, it sits in our DeFi lesson on sandwich attacks, block builders and the protection routine, which this lesson does not repeat.
What MEV in crypto is: the block producer sells an ordering
Consensus agrees on a list, not on a fair order
A block is an ordered list of transactions. Every consensus family, proof of work, proof of stake or a BFT vote, exists to make thousands of nodes accept the same list. None of them defines a fair order. The protocol checks that each transaction is valid and paid for; the sequence is left to whoever writes the block.
That sequence has a price because the result of a transaction often depends on what ran before it. A swap on an automated market maker gets a price that depends on the pool’s balances at that moment. A liquidation goes to the first valid caller. An arbitrage between two pools pays only the first trader who closes the gap. Put your transaction one position earlier and you may win; one later and you may lose or fail.
Ethereum.org describes it as the extra value a block producer can capture, above the standard block reward and gas fees, by choosing which transactions to include or leave out and in what order. The same page recalls that the idea was first applied to proof of work and called “miner extractable value”. When Ethereum moved to proof of stake in September 2022 there were no miners left, so the M stayed and changed meaning: maximal.
Every leader holds a priced pen
Ordering power belongs to the leader of the moment, whatever the consensus family. On Ethereum it is the validator selected for each 12-second slot. On Solana it is the leader named in advance by the schedule we described in our lesson on Solana and proof of history. In Tendermint or HotStuff chains it is the proposer of the round, as seen in the lesson on BFT consensus. On a rollup it is usually a single sequencer run by one company.
Bitcoin has the power too, in a weak form. Its transactions do not interact the way smart contracts do, so there is little to gain from reordering them. The risk Bitcoin developers do plan for is “fee sniping”: a miner re-mining the latest block to take its fees. Bitcoin Core’s wallet usually sets each new transaction’s nLockTime to the current block height, so that it can enter the next block but not a rewritten copy of the last one, and the comment in its code explains the aim plainly: the subsidy is high enough and transaction volume low enough “that fee sniping isn’t a problem yet”. The word “yet” ties the question to every future halving.
| Chain or design | Who orders the block | What limits that power |
|---|---|---|
| Bitcoin | The miner or pool that finds the block | Few interacting transactions; wallets use nLockTime against fee sniping |
| Ethereum (proof of stake) | The slot’s proposer, which today usually signs a block made by an outside builder | Finality after about two epochs; proposer rotation every slot |
| Solana | The scheduled leader of each slot | Leader rotation; no protocol mempool, but private order flow exists |
| Tendermint and HotStuff chains | The proposer of the round | Two-thirds votes; proposer rotation |
| Rollups (layer 2) | Usually one sequencer | The ordering policy it publishes; forced inclusion through layer 1 |
From a fee war to an industry: 2019 to 2026
Priority gas auctions and “Flash Boys 2.0”
The name comes from a paper. On 10 April 2019, Philip Daian and seven co-authors, among them Ari Juels, posted “Flash Boys 2.0: Frontrunning, Transaction Reordering, and Consensus Instability in Decentralized Exchanges”. Its title echoes Michael Lewis’s book about high-frequency traders on Wall Street. The authors watched arbitrage bots on early decentralised exchanges fight over the same opportunities by raising their fees again and again, which they called “priority gas auctions (PGAs), competitively bidding up transaction fees”. The miner simply took the transaction that bid highest.
They put a floor of more than 6 million dollars on that bot economy at the time, and they made a darker point. The fees and profits a miner could capture by ordering transactions could exceed the block reward. A paid-up miner then has a reason to rewrite recent blocks. The paper named this value miner extractable value, or MEV, and treated it as a consensus problem, not a trading curiosity.
The dark forest and Flashbots
The Paradigm post of August 2020 made the idea popular. It credits Daian with a term for the bots it met: the “generalized frontrunner”, a program that copies any pending transaction it could profit from and swaps in its own address. You do not need to understand a trade to steal it; you only need to simulate it.
Priority gas auctions had a side effect everyone paid for. Bots flooded the network with bids and failed transactions, raising fees for all users. Flashbots, a research group formed in 2020, proposed to move the fight off the public network. In January 2021 it released the alpha of the Flashbots Auction, built on mev-geth, a patch of the go-ethereum client, plus a relay. Searchers sent bundles of transactions with a payment to miners through a private channel, and miners picked the most valuable. The Flashbots documentation does not soften its view: “The extraction of MEV introduces an existential threat to Ethereum’s consensus security.”
The Merge, MEV-Boost and proposer-builder separation
After the Merge of 15 September 2022, validators replaced miners, and the auction moved with them. Ethereum.org describes MEV-Boost as “an improvement on the Flashbots auction mechanism” and an implementation of the builder API. The validator chosen for a slot no longer assembles its own block. Specialised builders do, relays pass on their bids, and the validator signs the most valuable offer. That split is called proposer-builder separation, or PBS. Our DeFi lesson describes each of these actors and how a block is signed blind.
| Date | Event | Source |
|---|---|---|
| 10 April 2019 | “Flash Boys 2.0” names miner extractable value and priority gas auctions | arXiv 1904.05234 |
| 28 August 2020 | Paradigm publishes “Ethereum is a Dark Forest” | Paradigm |
| January 2021 | Flashbots Auction alpha (v0.1) for miners and searchers | Flashbots docs |
| 8 August 2022 | OFAC sanctions Tornado Cash | US Treasury |
| 15 September 2022 | The Merge: Ethereum moves to proof of stake | ethereum.org |
| 26 October 2022 | Peak share of MEV-Boost blocks from censoring relays, 94.8% | mevwatch.info |
| 21 March 2025 | Treasury removes Tornado Cash from its sanctions list | US Treasury |
| April 2025 | Arbitrum One starts using the Timeboost auction | Arbitrum docs |
| 10 April 2026 | FOCIL chosen as consensus headliner of the Hegotá upgrade | Ethereum Foundation |
| 6 October 2026 | Sepolia testnet activation listed for Glamsterdam, the upgrade that includes ePBS; no mainnet date | EIP-7773 |
Front-running, explained without a formula
Front-running means getting your transaction just before someone else’s because you know theirs is coming. In stock markets the information comes from a client’s order. On a public blockchain it comes from the mempool, the waiting room of transactions that any node can read, described in our lesson on the mempool and transaction fees. Your swap sits there, signed and readable, for a few seconds before a builder picks it up.
Picture three seats in a block: n-1, n and n+1. Your transaction sits in seat n. A front-runner wants seat n-1 and pays more to the builder to get it. Researchers describe three forms. Displacement: the attacker takes the opportunity and your transaction runs after it, finding nothing left, as Paradigm’s rescue did. Insertion: the attacker moves the price before you and profits from your trade after. Suppression: the attacker fills blocks so that yours waits.
The generalized frontrunner made displacement cheap. It does not need to know what your transaction does. It runs it in a simulation with its own address, and if the result is a profit, it sends the copy with a higher payment. That is why a transaction in a public mempool is readable in a deeper sense than a bank transfer: anyone can replay it.
The sandwich in three seats
A sandwich attack is insertion on both sides. The bot buys in seat n-1, pushing the price up. Your swap runs in seat n and buys at the worse price. The bot sells in seat n+1, at the price your swap pushed up. Its profit is roughly what you lost, minus pool fees, gas and the payment to the builder.
Two rules frame the attack. The bot cannot push the price past your slippage tolerance, the worst price your wallet accepts, or your swap would fail and its back-run would lose money. And you never see a separate charge: you simply receive fewer tokens than the quote suggested. Since MEV-Boost, the bot rarely has to race for its seats. It sends its two trades and a copy of your pending swap to builders as one bundle, to be executed in that exact order or not at all, so if it loses the auction it usually loses nothing but the time spent bidding.
For worked numbers on a pool, the effect of a 1 percent tolerance and the defences that help, see the DeFi lesson on sandwich attacks. What this lesson adds is the reason the attack is possible: whoever orders the block sells seats, and in a public mempool the bot knows in advance which seat is worth buying.
Back-running, arbitrage and liquidations: the other side of the trade
Not all MEV takes money from a person. A back-run is a transaction placed right after another to use the state it creates. If a large swap pushes a pool’s price away from other venues, an arbitrageur trading right after it brings the price back in line and keeps the difference. The trader who moved the price is not harmed by the arbitrage; the gap would exist anyway.
Liquidations work the same way. Lending protocols let anyone repay a loan whose collateral has fallen too far and keep a bonus, as set out in the lesson on how DeFi liquidations work. Bots compete to be first, and the competition is what keeps lenders whole when prices move quickly.
The line between useful and harmful MEV is debated, not settled. Respondents to a 2024 consultation by ESMA, the EU’s markets authority, listed claimed benefits: price discovery, price convergence between exchanges, quicker liquidations and rebates to users. The same ESMA report of December 2024 records their view that MEV cannot be “systematically assimilated to market abuse, despite some MEV practices being clearly abusive”. That is the respondents’ summary, not a ruling. A simple test helps a reader: arbitrage and liquidations react to a state; a sandwich needs a victim.
When ordering power threatens consensus: time-bandits and reorgs
The incentive: more value than the block reward
Daian and his co-authors described two forking attacks. In the first, a miner forks a block that contains a lot of MEV in order to take it. In the second, which they called a time-bandit attack, a miner rewrites a longer stretch of past blocks to capture value that has already been distributed. Their own illustration, written in March 2019, takes a token whose price jumps from 1 to 3 dollars on an automated market maker. If 1 million dollars of that token traded during the 24 hours a miner can rewrite, the miner can put itself on the buy side of every trade before the jump, a gross gain of 2 million dollars. The authors set that against the 1.78 million dollars a cost-tracking site then gave for renting enough hashrate to attack Ethereum for 24 hours: about 220,000 dollars of profit on paper.
Ethereum.org keeps the warning in its current text: “consensus nodes are incentivized to trigger chain reorganizations in time-bandit attacks”. The lesson for consensus is general. Security assumes that following the rules pays more than breaking them. If a block can hold more value than the honest reward, that assumption weakens.
What proof of stake changed, and what it did not
Proof of stake on Ethereum makes deep rewrites far harder. Once a block is finalised, after about two epochs or 12.8 minutes as explained in our lesson on finality and reorgs, reverting it would require at least a third of all staked ether to sign contradictory votes, which the protocol can prove and punish. The time-bandit of 2019, renting hashrate to rewrite a day, has no direct equivalent.
The short window before finality remains. Ethereum.org notes that validators “may be incentivized to reorg blocks and capture the MEV for themselves”. Here is the arithmetic on an example with invented numbers, which are not market data and describe no real block. Say the previous block left an opportunity worth 300 ETH, and the block you are due to propose would earn you about 0.05 ETH in rewards and fees. If you build on an older parent to grab the 300 ETH, either the network follows your fork and you keep it, or it rejects your block and you lose your 0.05 ETH. In this example the expected gain is the chance of success × 300 minus the chance of failure × 0.05, so the gamble pays as soon as the chance of success exceeds about 0.017 percent. Ethereum’s fork-choice rules, which weigh the votes of attesting validators, are designed to keep that chance close to zero. The larger the MEV in a single block, the more that design is tested.
In court: 25 million dollars in 12 seconds
The case that brought ordering power into a courtroom involves two MIT-educated brothers, Anton and James Peraire-Bueno. Federal prosecutors in Manhattan, who announced the charges on 15 May 2024, allege that in April 2023 the brothers baited three traders’ MEV bots with trades in illiquid tokens. When one of their own validators was picked to propose a block, they are accused of exploiting a flaw in the MEV-Boost software to see the bots’ pending transactions and rewrite them, taking about 25 million dollars in roughly 12 seconds, as DL News reported at the time. The people on the other side were professional bot operators, not retail traders. The counts were wire fraud, conspiracy and money laundering conspiracy; market abuse was not charged.
None of this has been proven. The trial before US District Judge Jessica Clarke ended in a mistrial on 7 November 2025 after the jurors deadlocked, with no verdict. At a hearing reported by DL News on 13 March 2026, the judge said she would decide the brothers’ bid for acquittal before setting any new trial, which would not open before November 2026. The federal case in Manhattan (docket 1:24-cr-00293) remains open, and the brothers are presumed innocent. The question the case raises for consensus is plain: when the protocol lets a proposer order a block, where does a legal strategy end and fraud begin?
Who orders Ethereum’s blocks today
Proposer-builder separation was meant to keep validators small and many. It succeeded on that side: a validator only has to pick the highest bid. Building a winning block, though, takes order flow, data and speed, and that side has concentrated. On 8 November 2026 at 09:40 UTC, relayscan.io counted builders over the previous 24 hours, with data up to slot 15,608,899.
| Builder | Blocks, 24h to 8 Nov 2026 | Share, 8 Nov 2026 | Share, 1 Nov 2026 |
|---|---|---|---|
| Titan | 3,321 | 51.79% | 52.51% |
| Quasar | 1,526 | 23.80% | 14.67% |
| Eureka | 586 | 9.14% | 9.41% |
| BuilderNet | 565 | 8.81% | 16.28% |
Titan and Quasar together built about three blocks in four in that window, and the top four builders more than 93 percent of the blocks tagged on relayscan. The 1 November column comes from the same site, read for our DeFi lesson: in one week Quasar gained nine points and BuilderNet lost about half its share, while Titan barely moved. Set against the 7,200 slots of a day, the 6,413 blocks tagged to a builder mean that roughly 89 percent of slots went through MEV-Boost, a rough ratio of ours that leaves out missed slots. Relayscan also estimates Titan’s profit for those 24 hours at about 22.1 ETH, from changes in the builder’s balance, a method the site itself says can be off.
Why does it concentrate? A paper posted on arXiv on 6 May 2026 by Zhang and co-authors, studying Ethereum from September 2023 to August 2025, attributes 71 percent of builders’ trading-related revenue to exclusive order flow, deals that send some users’ transactions to one builder only, and concludes that “builder centralization is an emergent property of the PBS framework itself.” Ethereum.org says the same in milder words: MEV extraction “is believed to be capable of accelerating validator centralization”. PBS moved the pressure from validators to builders. It did not remove it.
Censorship: when the block builder follows sanctions law
From 94.8 percent to 16.7 percent
On 8 August 2022, the US Treasury’s Office of Foreign Assets Control (OFAC) sanctioned the Tornado Cash mixer. Several relays chose to filter transactions linked to the sanctioned addresses, and so did some builders. Mevwatch.info, which tracks the share of MEV-Boost blocks delivered by relays it classes as censoring, shows a peak of 94.8 percent on 26 October 2022. On 7 November 2026 the share was 16.7 percent, after a low of 11.9 percent on 4 November.
Those figures need care. The site’s labels are, in its own words, “an editorial classification”. Today it classes bloXroute’s regulated relay and Flashbots’ relay as censoring and Ultra Sound, Titan, Aestus and Agnostic as neutral. A block delivered by several relays counts more than once, so the share is a ratio of deliveries, not an exact count of blocks. And a neutral relay can still carry a block from a builder that filters.
The legal backdrop moved too. On 21 March 2025 the Treasury announced that it had “exercised our discretion to remove the economic sanctions against Tornado Cash”. Relays that filter today do so by their own policy.
Censorship and MEV are the same power
A 2023 study by Anton Wahrstätter and ten co-authors, “Blockchain Censorship”, found that 46 percent of Ethereum blocks were then made by actors intending to comply with OFAC sanctions, and that after the move to proof of stake and PBS, censored transactions waited on average 85 percent longer to be included. The authors add that such delays can strengthen a sandwich adversary. The point for this lesson is that excluding a transaction and placing it are two uses of one pen. Whoever can choose the order can choose to leave you out.
What the protocol is doing about MEV
ePBS (EIP-7732): moving the auction inside Ethereum
EIP-7732, enshrined proposer-builder separation, would make builders a staked entity of the beacon chain. The proposer would commit to a builder’s signed bid, and a committee of validators would attest whether the builder revealed its payload on time. The goal is to replace trust in relays with rules the protocol enforces. As of 8 November 2026 the EIP page still shows it in Last Call, a final review window that closed on 1 November, and EIP-7773, the list of what goes into the Glamsterdam upgrade, has it among the proposals scheduled for inclusion. No mainnet date has been announced. In its Checkpoint #9 post of 10 April 2026, the Ethereum Foundation called ePBS “a major sticking point” of Glamsterdam and said its implementation was “proving to be trickier than anticipated”.
Even if it ships, the builder keeps the pen. ePBS rewrites how a bid is paid for and delivered, not the sequence of transactions inside the block.
FOCIL (EIP-7805): forcing inclusion
EIP-7805, fork-choice enforced inclusion lists, answers censorship rather than extraction. Each slot, a committee of 16 validators publishes lists of pending transactions, each list capped at 8 KiB. Attesters support a block only if it contains the transactions of those lists, unless the block is full or a transaction is invalid. Its stated motivation is that a few dominant builders weakened Ethereum’s censorship resistance. The EIP is still a Draft, created on 1 November 2024. The Ethereum Foundation announced on 10 April 2026 that FOCIL was selected as the consensus-layer headliner of Hegotá, the upgrade after Glamsterdam, and said Hegotá’s timing would depend heavily on Glamsterdam’s progress.
In effect, FOCIL guarantees that a transaction gets in, not where. A builder can still place its own trades around a transaction it is forced to include.
| Answer | What it changes | Status as of 8 Nov 2026 |
|---|---|---|
| MEV-Boost (PBS outside the protocol) | Builders compete, validators pick the best bid through relays | Live; MEV-Boost blocks in about 89% of slots on 8 Nov 2026; relays trusted |
| ePBS, EIP-7732 | Staked builders and a payload timeliness committee replace trusted relays | Last Call; scheduled for Glamsterdam; no mainnet date |
| FOCIL, EIP-7805 | Validator committees force inclusion of listed transactions | Draft; Hegotá consensus headliner; not scheduled |
| Private routing | Transactions skip the public mempool | Live; trust moves to the operator; see the DeFi lesson |
MEV beyond Ethereum’s main chain
Layer 2: one sequencer, one order
Most rollups, explained in our guide to layer 1 and layer 2, have a single sequencer that orders every transaction. That is ordering power in its purest form, held by one operator, limited by the policy it publishes and by an escape hatch. On the OP Stack, for example, “any user can send an L1 transaction to submit an L2 transaction”, in which case the batcher is bypassed, per the Optimism documentation.
Arbitrum shows how the choice of policy shapes MEV. Its sequencer long ran first come, first served, which rewards speed and pushes traders to spend on latency. Since April 2025, Arbitrum One has used Timeboost, a sealed-bid, second-price auction for a 60-second “express lane” while other transactions are delayed by 200 milliseconds. The result echoed Ethereum’s builder market. A study by Johnnatan Messias and Christof Ferreira Torres, revised on 9 October 2026, counted about 494,000 auctions and more than 48.5 million express-lane transactions from January 2025 to April 2026: three entities won 99.74 percent of auctions. Competition in the auctions, and the DAO’s revenue with it, declined once resellers began offering dedicated lanes for arbitrage between centralised exchanges and DEXs.
In June 2026 Offchain Labs proposed to the Arbitrum DAO a move to priority gas auctions, in which the sequencer orders transactions by their priority fee in 125-millisecond rounds. Arbitrum’s documentation says the new ordering activates some time after an on-chain vote passes and that Timeboost is switched off the same day; as of 8 November 2026 it gives no activation date for Arbitrum One. Commenters on the proposal raised the risk of sandwiches; Offchain Labs answered that the sequencer’s mempool stays private, so the order is published only after sequencing. The name priority gas auction is the one Daian used in 2019 for the fee wars of Ethereum’s first bots, this time as an official rule.
Solana: a leader, tips and no public mempool
Solana’s protocol has no mempool, yet MEV runs through Jito, whose validator client accepts bundles of transactions with tips. The DeFi lesson covers how it works. As of 8 November 2026, DefiLlama counts about 4.4 million dollars of Jito MEV tips over 30 days, 59.1 million over a year and 1.44 billion since its records began. The 30-day figure stood at 5.39 million a week earlier, a reminder that MEV moves with trading activity.
Why MEV in crypto concerns ordinary users
The first cost is invisible. A sandwiched swap does not show a fee line; it shows a worse price. A failed transaction on a public route still costs gas. A trade that moved a pool pays for the arbitrage that follows only indirectly, through the price it got.
The second cost is trust. Users who were hit tend to switch to private routes, and that helps, but it does not close the question. Davide Mancino and Davide Rezzoli, in a paper posted on 19 December 2025 using data from November 2024 to February 2025, found that about 40 percent of sandwich victims moved to private routing within 60 days, rising to 54 percent after repeated attacks. They also identified 2,932 sandwich attacks through private channels in November and December 2024 alone, and concluded that “private routing does not guarantee protection from MEV extraction”.
The third cost is structural. With Titan and Quasar building three blocks in four, the internal rules of two companies shape what most Ethereum users get into a block, and where. When relays filter, some transactions wait. When a rollup’s single sequencer sells priority, the rule decides who trades first. None of this is visible in a wallet.
The hunters are not safe either. On 20 June 2026, the sandwich bot known as jaredfromsubway.eth was drained of about 7.5 million dollars, as valued by the security firm Blockaid and reported by The Block, through 66 counterfeit token contracts paired with fake pools built to bait it. An account presenting itself as the bot’s operator later spoke of 15 million dollars, a figure The Block could not verify. A strategy that trades automatically on anything profitable can be fed poison.
Scale matters too. The sandwich numbers on Ethereum fell over 2025, and the DeFi lesson gives them. Ordering power, however, has not gone anywhere: it has moved from miners to builders, from public auctions to private flow, and from layer 1 to sequencers. The habits that limit your exposure are in our guide to using a DEX safely and in the DeFi lesson’s routine.
Is front-running in crypto illegal? Securities law and the chain
In the United States, front-running is a defined violation in securities markets. FINRA Rule 5270, adopted in 1987 and last amended with effect from 3 September 2013, bars member firms and their staff from trading ahead of an imminent block transaction while holding material non-public information about it. The rule binds broker-dealers that handle client orders. A bot reading a public mempool is not a FINRA member, and it uses information anyone can see. The best-known US criminal case about ordering power, the Peraire-Bueno prosecution, relies on wire fraud. No SEC or CFTC text cited here addresses on-chain sandwiching by name.
In the European Union, the Market Abuse Regulation names “the practice commonly known as ‘front-running'” in its recital 30 as excluded from protections for market makers, while its articles 7 and 12 define inside information, including a client’s pending orders, and market manipulation. For crypto-assets admitted to trading, MiCA’s Title VI, articles 86 to 92, carries the same logic, wherever the trade takes place. Article 87(1)(b) treats as inside information what a client conveys about its pending orders, but only for persons who execute orders on that client’s behalf. Article 89 bans insider dealing, article 91 market manipulation, and article 92 requires persons professionally arranging or executing transactions to detect and report suspected abuse, naming even “the consensus mechanism” among the aspects to watch. Whether and how these articles reach a searcher or a builder reading a public mempool is a matter of interpretation, not settled law; our guide to the MiCA regulation and the DeFi lesson’s legal section set out what ESMA has said so far. Nothing here is legal advice.
What the law has not settled is the starting point of front-running on a chain: in a regulated market, the front-runner abuses information entrusted to it. In a public mempool, the victim broadcast its own order to the world.
