On 30 April 2026, Vitalik Buterin swapped 26,544 XDB tokens, worth about 3.86 dollars by CoinDesk’s count, for a sliver of ether. The bot known as jaredfromsubway.eth wrapped itself around that trade in block 24993038, pushing about 1.14 million dollars of WETH through SushiSwap and Uniswap V2 and paying 5.14 dollars of gas. It appears to have lost money on the attempt. Buterin likely lost a few cents.
The joke carries the whole lesson. A sandwich attack in crypto needs no hack and no stolen key: a bot reads your pending blockchain, where users swap tokens directly from their own wallets without handing custody of their funds to a company.">swap, buys just before you, lets your trade push the price up, and sells just after. Nothing suggests the bot singled out Buterin. CoinDesk summed it up in one line: “The MEV gods do not discriminate.” The position of a transaction inside a block has a price, and an entire industry now exists to buy and sell that position.
Where this sits in the map of DeFi risks is between economic and user risk. If making a swap safely is new to you, start there. Here the questions are harder: who orders an Ethereum block, what each protection tool asks you to trust, and why the same game looks different on Solana.
Arbitrage, liquidation, sandwich: the three trades behind MEV
Maximal extractable value (MEV) is, in the words of ethereum.org, “the maximum value that can be extracted from block production”, on top of the usual block reward and fees. Whoever decides what goes in a block, and in what order, can collect it. Three trades make up most of what readers meet.
Arbitrage closes a price gap between two pools, and it is generally seen as useful: it keeps prices aligned, often with a flash loan for capital. Liquidation is the race to repay an unhealthy loan and collect the bonus, covered in our lesson on DeFi liquidations. The sandwich is the one that takes money directly from a person: it is a trade placed on each side of yours.
The scale on Ethereum is smaller than the noise around it suggests. EigenPhi data reported by Cointelegraph on 4 December 2025 counted more than 95,000 sandwich attacks from November 2024 to October 2025, for about 60 million dollars a year of trader losses. Monthly extraction fell from nearly 10 million dollars in late 2024 to about 2.5 million in October 2025. The same data gives attackers a margin of about 5 percent, just above 3 dollars of average profit per attack, and says block builders take most of the value through gas fees. Roughly 70 percent of attacks came from jaredfromsubway.eth. CoinDesk adds, without naming a source, that the bot has reportedly extracted more than 7 million dollars from victims across hundreds of thousands of transactions.
From mempool to block: who orders your transaction
Searchers, builders, relays and the validator
When you sign a swap in a default wallet setup, it travels to the public mempool, the waiting room that any node can read. Four specialists then handle it. Searchers scan that waiting room and run bots that assemble profitable bundles. Builders collect those bundles and ordinary transactions, then assemble the most valuable full block they can. Relays sit between builders and validators and pass on the best bid. The validator chosen for the slot signs one block and takes the payment.
Few users ever see these actors. The order shown on a block explorer came out of an auction that fits inside one 12-second slot.
Why Ethereum split the roles: proposer-builder separation
Building a top-value block takes data, private deal flow and fast infrastructure. If only those who had them could earn full rewards, staking would drift to the largest operators. Proposer-builder separation (PBS) answers this by separating the two jobs: specialists compete to build, and a validator with modest hardware only picks the highest bid. Flashbots describes MEV as a centralising force on Ethereum and built MEV-Boost as an implementation of this split. The centralisation does not vanish. It moves from validators to builders, as the numbers further down show.
Sandwich attack crypto example: 60,000 dollars, 1 percent slippage
The following is an example with invented numbers, not a measured case and not a market price. Take a Uniswap V2 style smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool with a 0.3 percent fee, holding 3,000,000 USDC and 1,000 ETH, so a price of 3,000 dollars. You buy ETH with 60,000 USDC and set a 1 percent slippage tolerance. Alone in the pool, your trade returns 19.5502 ETH at an average of 3,069 dollars, because the constant-product formula moves the price against any large order. Your wallet therefore accepts anything down to 19.3547 ETH.
A bot computes the largest front-run that keeps you just above that floor. Solving for that size gives about 15,286 USDC.
| Step (example) | Trade | Pool after (USDC / ETH) | Price after |
|---|---|---|---|
| Start | None | 3,000,000 / 1,000.000 | $3,000.0 |
| 1. Front-run | Bot pays 15,286 USDC, gets 5.0543 ETH | 3,015,286 / 994.946 | $3,030.6 |
| 2. Your swap | You pay 60,000 USDC, get 19.3547 ETH | 3,075,286 / 975.591 | $3,152.2 |
| 3. Back-run | Bot sells 5.0543 ETH, gets 15,803 USDC | 3,059,483 / 980.645 | $3,119.9 |
You receive 0.1955 ETH less than you would have, about 587 dollars at the 3,000 dollar reference price, and your average price rises to 3,100 dollars. The bot ends with about 517 dollars gross, before gas and before what it pays the builder. The bot gets less than you lost largely because it pays the pool fee on both of its trades.
Your tolerance sets the size of the prize. It is, in effect, the largest donation you agree to make, as this recalculation of the same pool shows.
| Tolerance (example) | Largest front-run | You lose (at $3,000) | Bot gross |
|---|---|---|---|
| 3% | $46,564 | 0.5865 ETH, $1,760 | $1,549 |
| 1% | $15,286 | 0.1955 ETH, $587 | $517 |
| 0.5% | $7,614 | 0.0978 ETH, $293 | $259 |
| 0.1% | $1,518 | 0.0196 ETH, $59 | $52 |
At 0.1 percent the gross falls to 52 dollars, which then has to cover gas and the builder’s payment. That squeeze fits the EigenPhi figures above: a thin margin for the attacker, a larger share for the builder who sells it a place in line. Even with no bot at all, fee and price impact cost you about 0.45 ETH, or 1,349 dollars, on this trade. No protection tool removes that: only a deeper pool or a smaller order does.
MEV-Boost sells about nine blocks in ten
The sidecar, the relays and a block signed blind
MEV-Boost is open source middleware that validators run as a sidecar to their consensus client. It connects to one or several relays, which aggregate blocks from builders and offer the best bid. Flashbots, which built it, estimates that it can raise staking rewards by over 60 percent, an undated figure from the project itself.
The odd part is the signature. The EIP-7732 text explains that proposers outsource the block and sign a blinded version of it, trusting another party to supply the contents afterwards. That party is the relay, which Flashbots calls a "doubly-trusted" layer: builders trust it to route their block fairly, proposers trust it for validity and data availability. A piece of infrastructure outside the Ethereum protocol therefore holds a central position in block production.
Titan, BuilderNet and Quasar build most blocks
These are readings from relayscan.io for the 24 hours ending at 10:06 UTC on 1 November 2026. The order moves from day to day: over the seven days to 10:01 UTC, Titan held 53.44 percent, Quasar 17.38 percent and BuilderNet 13.90 percent.
| Builder (24h to 1 Nov 2026) | Blocks | Share of tagged blocks |
|---|---|---|
| Titan | 3,415 | 52.51% |
| BuilderNet | 1,059 | 16.28% |
| Quasar | 954 | 14.67% |
| Eureka | 612 | 9.41% |
| bombora.build | 169 | 2.60% |
| Builder+ | 121 | 1.86% |
| bobTheBuilder.xyz | 101 | 1.55% |
The builder rows on that page add up to 6,504 blocks. Ethereum has 7,200 slots a day, so by our own arithmetic about 90 percent of the day’s slots carried a MEV-Boost block, an estimate that ignores missed slots. The top three builders made 83.5 percent of the sample, and Titan alone more than half.
Relay figures need a warning. They count payloads delivered, and the 17,802 payloads of that day are more than twice the number of slots, so the same block is evidently counted under several relays. Read them as a ranking, not as market shares: ultrasound.money 33.45 percent, Titan’s relay 31.44 percent, aestus 19.87 percent, bloXroute’s regulated relay 13.13 percent. Titan thus appears at the top of both tables. Flashbots, which started all this, had 1.59 percent.
Enshrined PBS: EIP-7732 is scheduled, not live
EIP-7732 would move the auction into the protocol. Builders become staked entities, with as little as 1 ETH. A block carries a builder’s signed bid, paid from its beacon chain balance, instead of the execution payload itself; a new Payload Timeliness Committee of validators then attests that the builder revealed the promised payload on time. The relay’s role as a trusted party for payment and delivery would no longer be needed for that route, although the text still allows trusted payments outside the protocol.
Status as of 1 November 2026: the proposal is in Last Call, with a deadline of that same date, and EIP-7773 lists it as scheduled for inclusion in the Glamsterdam upgrade. It is not live on mainnet. EIP-7773 gives a Sepolia testnet activation on 6 October 2026, and Hoodi was next, on 26 October at 17:42:48 UTC. Core developers postponed that on their ACDE #248 call. The Ethereum Foundation post of 22 October says “A new activation date has not been set”, ties the delay to further investigation of how EIP-8037 interacts with mainnet smart contracts, and sets no mainnet date.
The design is also still being corrected. CoinDesk reported on 27 October 2026 that a draft rule could credit a staking service’s deposit to a builder registered under the same public key. The researcher avsetsin, listed as a member of Lido’s GitHub organisation, raised it and described “conditional code findings, not confirmed live exploits”. The fix was merged on 26 October, client teams still have to implement it, and no loss was reported.
Note what ePBS leaves alone: it changes how the auction runs and who must be trusted, not whether a sandwich pays. A swap you broadcast publicly stays readable.
Four defences on Ethereum, and what each asks you to trust
A slippage limit: the first and weakest line
A limit needs no third party, and the tables above show what it does: it caps the loss and shrinks the prize. It does not hide anything, so a bot can still take everything you allowed. Set it too tight and the swap fails on a normal price move, and on a public route you still pay gas for the failure. The aggregators described in our guide to DeFi aggregators often suggest a value, which you can still check.
Flashbots Protect: hiding the swap from the waiting room
A private RPC changes where your wallet sends the transaction. With Flashbots Protect, it skips the public mempool, so sandwich bots watching there have nothing to read. Transactions are included only if they do not revert, so a failed swap costs no fee, and you can earn an MEV refund if your trade creates value for a backrunner. In fast mode, the transaction is shared with all registered builders within one block, and full transaction details also go to searchers running in trusted execution environments. On the default RPC, 10 percent of the MEV-Share refund goes to validators; in fast mode they get more.
The same page carries warnings. Protect drops transactions with a priority fee of zero. If you use MetaMask, do not switch RPCs before confirmation, since the wallet may resend the transaction to the public mempool. And the trust is stated outright. When you send to a builder, “you trust them not to frontrun your transaction or disclose it to third-party MEV searchers”.
MEV Blocker and BuilderNet: selling the backrun back to you
MEV Blocker is also an RPC, with a different bargain. It sends your transaction to a network of searchers who may bid for the right to backrun it but, by its terms, cannot front-run or sandwich it. Winning bids split 90 percent to you and 10 percent to the validator, paid in the same block. As of 1 November 2026 its site shows more than 5.5K ETH rebated and a median rebate of 26 dollars, both its own figures. Endpoints differ: the default /fast route offers no protection against reverts, /noreverts does, and /fullprivacy gives up the rebate.
It no longer belongs to its creators. CoW DAO, Agnostic and Beaver Build launched it in 2023; CoW’s announcement and the MEV Blocker site now say Special Mechanisms Group (SMG) has acquired the RPC. Older guides name an operator you would no longer be trusting.
BuilderNet, public since 26 November 2024, attacks the same problem from the builder side: its instances share order flow and refund users the value that flow adds to blocks. It was designed around trusted execution environments (TEEs), secure hardware enclaves. Its docs, read on 1 November 2026, carry an undated caveat during a move to a new security model: “BuilderNet nodes are not running in TEEs, but backrunning and routing services continue to run in TEEs.”
CoW Protocol: when the order stops mattering
CoW Protocol takes a different route. You sign an intent, not a transaction, stating what you want to receive. Independent, bonded solvers compete to settle a batch of intents. A directed pair appearing several times in the same auction settles at one uniform price, which, in CoW’s words, “makes transaction order irrelevant within the block”. When two users want opposite sides, a coincidence of wants lets them trade without touching a pool, so nothing is exposed to a bot there.
The cost is a change of trust and of timing. You rely on the solver competition and on the protocol’s rules, your order waits for its batch, and a solver that does route to a pool still meets that pool’s depth. Size and token depth remain your problem.
| Tool (as of 1 Nov 2026) | What it changes | What you trust | Limit |
|---|---|---|---|
| Slippage limit | Reverts beyond a set loss | No one | Hides nothing; the allowance can be taken |
| Flashbots Protect | Avoids the public mempool, no failed-transaction fee, refunds | Flashbots and builders | No zero priority fee; do not switch RPC while pending |
| MEV Blocker | Searchers bid to backrun; 90% to you | Its operator, now SMG, and its searchers | Rebate depends on a backrun existing |
| BuilderNet | Shared building, refunds | Its operators; nodes outside TEEs during the transition | Security model in transition |
| CoW Protocol | Uniform price per batch, intents | Solvers and protocol rules | Waits for a batch; pool depth still applies |
MEV on Solana: no public mempool, same game
Jito: bundles, tips and the Block Engine
Solana’s protocol has no mempool of its own. Jito-Solana, a modified validator client, took over most stake: Helius’ report put it at 48 percent at the start of 2024 and 92 percent at the start of 2025. Searchers and apps submit to Jito’s Block Engine bundles of up to five transactions, executed in order and all-or-nothing. A bundle needs a tip of at least 1,000 lamports, sent to one of eight tip accounts, and tips are redistributed to validators and their stakers.
That is the link with proof of stake coin with a protocol that stakes it for you and issues a transferable token (such as Lido stETH or rETH) representing the deposit plus rewards, which you can use or sell while the coins stay staked.">JitoSOL, a liquid staking token whose yield includes MEV. Jito’s technical FAQ says a TipRouter system handles MEV rewards at epoch boundaries, with 97 percent going to validators and stakers and a 3 percent protocol fee, and that its stake pool requires an MEV commission of 10 percent or less. Whoever holds JitoSOL therefore receives a small part of what traders pay for priority, sandwiches included where they run through Jito. As of 1 November 2026, DefiLlama shows about 985 million dollars in Jito liquid staking.
| Solana MEV figure | Value | Date and source |
|---|---|---|
| Jito-Solana share of stake | 92% | Start of 2025, Helius |
| Jito tips, one year | 3.75 million SOL across more than 3 billion bundles | Past year at the Helius report, early 2025 |
| Tips in the last 30 days | $5.39 million | 1 Nov 2026, DefiLlama |
| Tips in the last year | $60.3 million | 1 Nov 2026, DefiLlama |
| Tips all time | $1.44 billion | 1 Nov 2026, DefiLlama |
| Vpe sandwich program, 30 days | 1.55 million sandwiches, 65,880 SOL profit ($13.43 million) | 7 Dec 2024 to 5 Jan 2025, Helius |
March 2024: the mempool Jito switched off
The removal of the mempool on Solana is often misdescribed. What closed in 2024 was Jito’s own feature, a stream in its Block Engine that let searchers see pending transactions, not a part of the Solana protocol. Jito announced the suspension on Friday 8 March 2024. Jito Labs contributor Lucas Bruder gave CoinDesk this explanation in a statement added on 9 March: “in the absence of an engineering solution we have made the difficult decision to suspend the mempool.” Helius says the decision cost Jito significant revenue.
Sandwiches moved to private mempools
Sandwiching did not stop. It moved to private, permissioned mempools, in which a few parties get access to pending transactions. The Helius report says that much of it came from a private mempool run by a single entity, DeezNode, whose validator held about 811,605 delegated SOL at the time. Jito’s internal analysis, cited there, attributes nearly half of Solana sandwiches to one program, the Vpe program. In the 30 days to 5 January 2025, that program executed 1.55 million sandwiches with an 88.9 percent success rate, 0.0425 SOL of average profit and 22,760 SOL of Jito tips. Of the 20 most sandwiched tokens, 16 came from Pump.fun.
The Solana Foundation answered with stake, not code. The Block reported on 10 June 2024 that it removed several operators from its delegation program over their role in sandwich attacks. They can still run validators, without Foundation-delegated SOL.
What Solana users can actually do
The first lever is the same as on Ethereum: slippage. Helius notes that memecoin traders often set it high, which exposes them. Jupiter added dynamic slippage in August 2024. Its Ultra documentation describes a real-time slippage estimator and landing through its own infrastructure, with transactions hidden until execution. That same page now says the Ultra Swap API is no longer actively maintained and was superseded by Swap V2, so check what the Jupiter interface you use really does. Treat any sandwich-rate claim as marketing unless an independent tracker confirms it.
Beyond that, Helius lists a MEV Protect mode in some tools that routes only to Jito block engines, at a slightly higher fee, and RFQ swaps that fill directly with off-chain market makers, which work best on widely traded tokens. It adds, as anecdote, that many Telegram bot users leave protection off even when offered. Developers can add an account starting with jitodontfront to a transaction: the Block Engine then rejects bundles that do not put it first. That rule applies only inside Jito’s engine, and Jito itself offers it as mitigation, not a guarantee.
Is a sandwich attack legal? What the EU and the US have said
The EU has not banned MEV. Under the MiCA regulation, Articles 89, 90 and 91 prohibit insider dealing, unlawful disclosure and market manipulation by any person, and Article 92 obliges those who professionally arrange or execute transactions (PPAETs) to detect and report suspected abuse. ESMA’s final report of December 2024 draws the line clearly. In paragraph 46 it concludes that “miners, validators, searchers, and builders should not be considered as PPAETs”. In paragraph 41 it says those same actors could be held liable if they breach Articles 89, 90 or 91.
So those roles alone carry no Article 92 reporting duty, and no immunity. Some respondents to ESMA’s consultation called sandwich attacks, time-bandit attacks and the use of inside information from private mempools inherently abusive, while treating DEX arbitrage and DeFi liquidations as legitimate. That split is theirs, not a legal ruling. ESMA’s guidelines dated 9 July 2025 then encourage national authorities to understand the risks posed by traders, miners and validators, naming MEV strategies, and suggest they could monitor “abusive MEV strategies”. They address supervisors, not users. Any claim that the EU has outlawed MEV does not match this text.
In the United States, the case to know is not about sandwiching retail users. Prosecutors in Manhattan accused brothers Anton and James Peraire-Bueno of taking about 25 million dollars by exploiting MEV bots, the bots being the alleged victims. These are allegations: the trial ended in a mistrial in November 2025 when jurors could not agree, with no verdict.
The brothers then asked the judge to throw out all charges, and DL News reported in March 2026 that she would rule on that before scheduling any new trial. In a joint letter of 30 March 2026, the government said it remained available for a retrial, and the defence asked that any retrial start from June 2027. The latest reporting we rely on dates from that month, so check docket 1:24-cr-00293 in the Southern District of New York for later steps. None of this is legal advice.
What no private RPC fixes
A slippage limit asks you to trust no one. Every routing tool above moves trust instead of removing it. Private routes rest on a promise from an operator or a builder, and three builders made 83.5 percent of the blocks in the sample above, so a leak or a policy change at one of them would reach most of the market. Refunds also depend on your trade creating a backrun at all.
Protection also stops at the sandwich. A hidden swap still pays price impact and the pool fee, and an arbitrageur can still act right after it lands. On Solana, the private mempools that replaced Jito’s stream are invisible by design. And ePBS, when it comes, will change the plumbing of the auction without making pending public transactions private.
A protection routine for large swaps
- Estimate the trade first: if price impact alone is above your slippage limit, split the order or find a deeper pool before thinking about bots.
- On Ethereum, send swaps of real size through a private RPC or an intent-based venue, and know which operator that is today.
- Set slippage for each token: tight on deep pairs, and treat any thin token that needs several percent as a trade with a built-in donation.
- Add a priority fee when using Flashbots Protect, and do not change RPC in your wallet while a transaction is pending.
- Try the route with a small amount first, then read the block on an explorer: a trade from the same bot address just before and after yours is the signature of a sandwich.
- On Solana, check what your interface really sends, prefer RFQ on liquid pairs where it exists, and look for a protection setting in any Telegram bot before using it.
Those habits are general education, not advice on any trade. Tools change hands and designs: MEV Blocker was sold in January 2026, BuilderNet’s nodes are in a security transition, and Jupiter has replaced its Ultra API. The next date to watch is the new Hoodi activation for Glamsterdam, which the Ethereum Foundation says it will announce later.
