mev

The founder of the Solana landing service analysis platform Circular, Ben, stated that he believes the trading terminal Axiom charges traders through misleading "validator bribes" and routes the related funds to the landing service Lunar under HelloMoon. Ben mentioned that since April, the bribes paid by Axiom traders to Lunar amount to approximately $55.7 million, but the latest 30-day analysis shows that only about 1% can be traced back to additional on-chain validator incentives, and he inquired whether Axiom shares in this tip revenue.Circular claims that it reconstructed the activities related to Lunar and Axiom from April 26, 2026, to October 19, based on on-chain payment flows: during this period, Lunar received 530,166 SOL in bribes, valued at approximately $55.67 million based on its quoted price of $105/SOL, corresponding to 189 million successful payments of bribes to Lunar from Axiom transactions. In the last 30 days, 45 million Axiom transactions made payments to Lunar, accounting for 80.6% of successful Axiom transactions; Lunar received 138,964 SOL, approximately $14.59 million, of which about 1,579 SOL was attributed to additional on-chain validator incentives, accounting for 1.14%.Ben also cited on-chain cases from September 26 and October 7, stating that after he paid bribes as suggested by the Axiom interface, the identifiable additional priority fee increase was about 1% of the amount paid to Lunar. He indicated that Axiom controls transaction routing and fee recommendations and has published its associated Lunar address on GitHub for verification. The above content represents Circular's on-chain statistics and personal judgment, and the post also states that the related proportions do not exclude other service costs or off-chain payments, and its estimate of the platform's revenue share is not based on tracked payments to Axiom.

According to official news from Aptos, the Aptos mainnet has officially launched the Encrypted Mempool feature. Users can choose to encrypt pending transactions before block finalization, keeping the transaction call functions and input content encrypted before execution, while the sender's address and fee information remain visible to the outside.This feature is mainly aimed at institutions (to avoid exposing intentions of large orders in advance), traders (to reduce MEV arbitrage risks), and AI entities (to ensure transaction inputs remain private before execution).

According to CoinDesk, the Layer 2 blockchain Robinhood Chain, designed for tokenizing real-world financial assets, is evaluating a transaction sorting system that allows users to pay fees for prioritizing specific transactions. This technology is developed by Arbitrum, the infrastructure provider for Robinhood Chain. Insiders say that Arbitrum's previously launched paid transaction sorting technology, Time Boost, could provide users with a 200-millisecond prioritization advantage, but it was replaced on September 24 by the new Priority Gas Auctions model, which allows traders to pay higher fees to prioritize individual transactions. This new version is what Robinhood Chain is currently evaluating.Currently, Robinhood Chain employs a first-come, first-served transaction sorting strategy and has not yet utilized Arbitrum's original Time Boost application. Since launching its Ethereum-compatible network in July, Robinhood Chain has rapidly gained popularity and has entered the top ten blockchains ranked by total locked value. Robinhood's traditional brokerage business has long profited through "payment for order flow," where market makers pay brokers for the routing rights of customer orders.The mechanism of on-chain paid transaction prioritization operates differently; it provides advantages to traders by accelerating transaction processing speeds, helping professional institutions compete for fleeting trading opportunities.

Aptos governance proposal #206 is currently voting, proposing to enable the ChunkyDKG V1 full mode and the encrypted_transactions feature. This mechanism will support encrypted transactions through distributed key generation, hiding their content before the transactions enter consensus ordering, and then collaboratively decrypting by validators, which helps reduce front-running and MEV risks.The proposal voting will end on October 6, and currently, the approval rate is close to 100%, but the voter turnout is only 2.69%, which has not yet reached the quorum requirement of 24.8%.

Co-founder and Chief Operating Officer of the cross-chain trading platform Relay, Jason Maier, stated that the team discovered an issue with the Relay API over the weekend, which exposed pending transaction information before trade execution. MEV seekers exploited the pending routing status to infer on-chain paths and front-run trades before order execution, resulting in worse execution prices for users trading through Relay.This activity occurred from September 12 to September 26, primarily concentrated from September 23 to 26. Seekers profited approximately $136,000 from this, affecting around 5,600 users, with a median impact of $11.88. Relay will pay a $50,000 bounty to Outputlayer for reporting the issue and will automatically compensate affected users without the need for applications; funds will be directly sent to wallets, with a total compensation amount of approximately $312,000.Jason Maier stated that MEV can arise through public mempool exposure, order detail inference, malicious participation in auctions, or data gaps between service providers, and protecting a single link in the transaction path is not sufficient. He mentioned that the team will continue to enhance the execution quality and privacy of the entire transaction path and called on security researchers to report vulnerabilities when discovered.

Aerodrome's Slipstream V3 has been launched, introducing protocol-level internal MEV auctions in concentrated liquidity AMMs, distributing the value captured by sandwich bots and arbitrageurs to active liquidity providers and sAERO token holders. The protocol expects related revenue to reach tens of millions of dollars.This version also introduces dynamic fees, automatically increasing fees during market volatility, and continues the concentrated liquidity design of Uniswap V3, achieving capital efficiency up to 4000 times that of traditional AMMs.Aero plans to integrate Aerodrome on Base with Velodrome on Optimism into a single AERO token, set to launch on the Ethereum mainnet in the second quarter of 2026; Aero Lite has launched the Slipstream pool on Circle's Arc, and Dromos Labs is developing pool-level fee rebates and KYC options for institutional clients.

According to CoinDesk, an attacker exploited a permission verification flaw in the Multicall contract authorized by the Safe multi-signature wallet, attempting to transfer approximately 2,900 rsETH (about 7.8 million USD). However, the automated trading bot Yoink discovered the transaction in the public trading pool, paid about 47,000 USD in fees to execute the transaction first, intercepted 2,882 rsETH, and transferred it to another address.BlockSec, Blockaid, Slow Mist, and AstraSec have all confirmed that the vulnerability lies in the components authorized by the user, rather than the core Safe contract. The issuer of rsETH, Kelp DAO, has implemented a 24-hour suspension on the receiving address.

An MEV bot named Yoink on Ethereum front-ran an exploit attack targeting the Safe wallet, which PeckShield referred to as an approximately $7.81 million rsETH attack. On-chain records show that the Yoink transaction received 2,900 rsETH and sent 2,882.37 rsETH to the address 0xC70f00CD7E461686b04B0E912E309becA8b80ea0, which currently has a balance of 2,882.36740883 rsETH.The same transaction also sent 17.63 rsETH to the Uniswap v4 Pool Manager, which sent 18.95 ETH to the Yoink contract, which then transferred 18.93 ETH to the block builder. The Yoink transaction and the original attack transaction both occurred in Ethereum block 25980525, with the Yoink transaction at the top of the block, and the original transaction executed a rollback, consistent with the front-running judgment of security researchers.BlockSec attributed the vulnerability to a flaw in the authorization checks of the executor contract associated with the enabled Safe module, allowing calls controlled by the attacker to be executed through a trusted executor. Blockaid stated that the attacker exploited a public keeper multi-call to direct a custom Uniswap v4 liquidity module to a hook pool created by the attacker, which subsequently unpacked aEthrsETH into rsETH.

Co-founder of Arbitrum Steven Goldfeder and co-founder of Solana Toly engaged in a debate over on-chain transaction fees, MEV protection, and the single sequencer model.Steven stated that one cannot simply compare surface-level fees. Arbitrum One and Robinhood Chain actively prevent front-running and most harmful MEV, while some chains that claim lower fees have higher MEV costs, including front-running against retail investors. He expressed a preference for paying clear fees upfront rather than incurring hidden losses from front-running, sandwich attacks, and other issues for the sake of lower fees.Toly countered that Arbitrum currently has a less favorable bid-ask spread and higher fees. The 10% cut taken from transaction fees alone translates to a cost in basis points that exceeds the loss rate from sandwich attacks, which he estimates to be about 10 times that of the latter, not accounting for the impact of the spread. He emphasized, "A single sequencer that pursues shareholder value maximization can never outperform permissionless competition."

The venture capital firm a16z crypto published an article stating that blockchain throughput has increased more than 100 times in five years, with some production systems now capable of processing tens of thousands of transactions per second. The article indicates that throughput alone cannot explain when transactions will settle; financial markets require predictability, including guarantees or censorship resistance, as well as ordering guarantees, to ensure transactions settle on time and operate under rules that participants can understand in advance.The article claims that resilience means no single operator controls access. a16z researchers introduced the concept of Strong Chain Quality, reserving block space to allow effective transactions to enter through multiple routes. Ordering rules must be clear, such as priority fees or venue rules, to avoid MEV and achieve fair price time priority. Additionally, privacy must be achieved through cryptography before execution, hiding intent until it is included in the final transaction, allowing the market to be auditable without real-time previews of unexecuted orders.

The LayerZero research team, in collaboration with Oblivious Labs and researchers from Carnegie Mellon University, has published a paper proposing a new automated market maker mechanism called OTTER, aimed at enhancing resistance to Maximum Extractable Value (MEV).OTTER employs a batch clearing mechanism similar to VCG auctions, making it a dominant strategy for traders to report valuations and budgets truthfully, while weakening the ability of block builders to profit through transaction ordering, sandwich attacks, or injecting false bids.

The sandwich attack bot operated by JaredfromSubway.eth has extracted a total of 117,007 ETH since March 2023, amounting to approximately $295 million at current prices. In June 2026, an anonymous attacker deployed 66 counterfeit token contracts, using the bot's automated trading logic to steal at least $7.5 million in ETH and stablecoins, transferring the funds to Tornado Cash; the related assets have not yet been recovered.Sandwich attacks are a form of Maximum Extractable Value (MEV): the bot monitors large transactions in the Ethereum public mempool, buys before the target transaction, and sells after the transaction drives up the price, extracting profits from the price difference. As of August 28, the main contract of the bot has received a total of 117,007 ETH.MEV-Boost block construction is concentrated among a few participants, with relay.ultrasound.money, Titan Relay, and bloXroute relays forwarding approximately 85% to 88% of the relevant blocks within a 24-hour window; Titan's builders independently assemble 50.3% of the blocks. The monthly extraction amount from sandwich attacks has decreased from about $10 million at the end of 2024 to about $2.5 million in October 2025.

According to GoPlus monitoring, a user on the Base chain lost 500,000 USDC due to a phishing attack. When the attacker exchanged the stolen funds for WETH, the script did not set slippage protection, routing to a Uniswap V4 WETH/USDC pool with almost no liquidity, resulting in only 67.9 ETH (worth $129,000) being exchanged for 500,000 USDC, of which $370,000 was earned by an MEV bot.The MEV bot only paid 0.03 USDC to front-run the transaction but incurred 3.5 ETH in gas fees for this. Subsequently, the victim sent an on-chain message to the attacker and the MEV address, stating that they had identified the attacker and were willing to pay a 10% bounty for a refund.

According to monitoring by PeckShield, the attacker-controlled address 0x920d...9708 stole approximately 500,000 USDC from the Base chain victim wallet 0x3a53...0B5c.However, during the subsequent process of exchanging USDC for ETH, the attacker did not set sufficient slippage protection, and the transaction was front-run by MEV bots for arbitrage. Ultimately, the attacker only obtained about 67 WETH, worth approximately $129,000, losing over 75% of the stolen funds.

According to Onchain Lens monitoring, the attacker of the MEV bot "JaredFromSubway" transferred 2000 ETH ($3.44 million) through Tornado Cash, sold 1422 ETH to obtain 2.446 million DAI, and currently has only 5 ETH ($8,630) left.

Members of the management team of the Ethereum Foundation (EF) and CSA Operator Aerugo published a systematic explanation of EF's mission. Aerugo stated that EF's core mission is to ensure that Ethereum becomes and continues to be a truly permissionless sovereign infrastructure: censorship-resistant, capture-resistant, open-source, private, and secure, capable of supporting large-scale trustless coordination.He emphasized that EF's focus is on eliminating extraction and capture risks that may arise at the protocol layer of Ethereum, particularly the two core challenges of MEV (Maximum Extractable Value) issues and the lack of default privacy. Aerugo described MEV as "the main battleground of the next cypherpunk war," and pointed out that "a public ledger without serious default privacy is a monitoring infrastructure with settlement guarantees."In addition, EF will move some of its work out of the foundation through spin-offs in the future, but will maintain strict standards for external funding. The recent departure of some personnel is part of normal organizational adjustments, and EF will handle it in a dignified manner without making personnel issues public.

The well-known MEV Bot address ae13 issued a white hat bounty notice on-chain to hackers, stating, "If 2,150 Ethereum is returned to this address within 48 hours, we are willing to pay 50% of the white hat bounty; otherwise, we will take all feasible legal and enforcement actions to hold accountable."According to previous reports, the well-known MEV robot Jaredfromsubway.eth (ae13), which has been active on the Ethereum network for a long time, was attacked by hackers exploiting vulnerabilities in the automated execution system, resulting in losses exceeding $75 million.

According to on-chain analysts, the well-known Ethereum MEV bot JaredFromSubway was attacked, resulting in a loss of approximately $7.5 million. The attacker constructed a false MEV arbitrage path, inducing the bot to automatically generate token approvals, and under the condition that the approvals were not revoked, used the open authorization to transfer WETH, USDC, and USDT from the bot's contract, with the funds ultimately flowing to the attacker's wallet address. Analysis indicates that this attack was not a traditional phishing or smart contract vulnerability, but a targeted exploitation of the bot's automation execution mechanism.