1. Search results are becoming part of the crypto attack path

Search engine results have quietly become one of the most underestimated weaknesses in cryptocurrency security.

The usual understanding of crypto security focuses on protecting seed phrases, using hardware wallets, enabling multi-factor authentication and being careful with suspicious links sent through email or direct messages. What is often missed is the role of search engines as an entry point for attacks.

For years, platforms such as Google have been seen as neutral gateways to the internet. Users are used to searching for their bank, favorite restaurant or a decentralized finance (DeFi) protocol, assuming the results are reliable. Scammers are now taking advantage of that behavior in crypto.

Recent incidents involving fake ads that impersonate major cryptocurrency platforms show that search engines are no longer just neutral information tools. Scammers have turned them into part of the attack surface targeting crypto users.

A wallet compromise does not always begin when a user connects to a malicious site. It may start several minutes earlier, with a normal search query and one wrong click.

2. How search engines became a crypto security risk

Traditional cyberattacks usually focused on technical weaknesses, such as software flaws, server exploits and malware. Modern crypto fraud works differently.

Instead of targeting systems, attackers target behavior.

Decades of internet use have trained users to trust search results, especially the ones that appear at the top of the page. A “Sponsored” label does not always make users more careful. Some may even see it as a sign that the listing is legitimate. They may also wrongly assume that the company behind the ad has been verified.

Neither assumption is always safe.

Search engines are designed to organize information and sell ads. Skilled bad actors understand both systems well. They can buy ad placements, manipulate visibility, copy trusted brand identities and reach users when they are most likely to act.

In crypto, that can be dangerous. A single transaction can move large sums instantly and usually cannot be reversed. That means one wrong click can have serious financial consequences.

Did you know? Google was not originally called Google. Its founders developed it as a research project called “BackRub,” named after its ability to analyze backlinks. Today, that same search system influences trillions of dollars in online activity, including crypto transactions.

3. The Uniswap impersonation campaign

A recent incident shows how effective this method can be. According to recent reports, attackers stole at least $400,000 from a trader through fake Google ads that impersonated the decentralized exchange Uniswap. 

The method was simple. A user searching for “Uniswap” would see what appeared to be an official sponsored listing near the top of the results. The branding looked familiar and the message seemed credible. This gave users little reason to be suspicious.

Clicking the ad took users to a cloned interface that closely copied the real Uniswap platform. From there, the experience looked genuine. Users connected their wallets, started what seemed like normal transactions and granted the required approvals.

The consequences became clear only later. The users had unknowingly approved permissions that allowed the attackers to withdraw funds directly from their wallets.

What makes this attack different is the lack of technical intrusion. The attackers did not need seed phrases, malware or broken encryption. The victims themselves signed the transactions that enabled the theft.

4. Why even experienced users fall victim

It is easy to assume that only newcomers to cryptocurrency fall for such schemes. In reality, even experienced users can be tricked under the right conditions.

One reason is authority bias. People naturally place trust in established institutions and systems. Google, in particular, is widely seen as a reliable way to find information. Users often assume that top search results are checked carefully before they appear.

Habit makes the problem worse.

For decades, the search bar has been the default way to move around the internet. Many users no longer memorize URLs. They simply search for the platform they want to visit.

Convenience also encourages speed.

Regular DeFi users often move quickly between exchanges, staking services, governance portals and bridge interfaces. The more urgent the action feels, the less likely users are to check every detail in front of them.

Attackers know this. They spend time and money creating convincing copies of trusted platforms. A fake interface that closely matches a familiar platform can lower even an experienced user’s guard, especially when that user is distracted or in a hurry.

There is also optimism bias. People may know that a threat exists but still believe they are unlikely to become the victim. Crypto’s track record gives little reason for such confidence.

5. The limits of hardware wallets

Hardware wallets are often described as the gold standard in cryptocurrency security. In many ways, that label is fair. By keeping private keys offline, they offer strong protection against many types of malware and unauthorized access attempts.

However, they have one major limit.

A hardware wallet cannot reliably judge whether a transaction benefits the user. If a user approves a malicious request through a phishing interface, the device will usually carry out the instruction exactly as submitted.

The hardware wallet protects the keys. It cannot always protect the judgment of the person using them.

This difference has become more important. The main threat is not always an attacker stealing credentials by force. Sometimes, the attacker simply persuades the target to use those credentials on a compromised platform.

Did you know? The first phishing attacks predate Bitcoin by decades. In the mid-1990s, attackers targeted AOL users by pretending to be employees and asking for passwords. The techniques have changed, but the basic idea remains similar: exploiting trust rather than technology.

6. Why search advertising appeals to bad actors

Search ads give criminals a mix of advantages that few other channels can match. For crypto scammers, that makes them especially attractive.

First, they offer access to large audiences. Millions of users search every day for terms linked to crypto wallets, exchanges and DeFi protocols.

Those users also have clear intent. A person searching for “Uniswap,” “MetaMask download” or “Ledger Live download” is already trying to take action. The attacker does not need to create interest. The possible victim is already ready to engage.

The barrier to entry is also relatively low. Phishing emails may be blocked by spam filters or ignored by recipients. Search ads, however, reach users at the exact moment they are looking for a destination.

Fraudulent campaigns can also be rebuilt quickly. When fake ads are taken down, attackers often return with new accounts, newly registered domains or slightly changed versions of the same scheme.

For criminals, the economics can be hard to ignore.

Did you know? Search results can vary from person to person. Location, browsing history and device type can all affect what users see. A scam ad seen by one crypto user may not appear for another user making the same search.

7. A problem that goes beyond Google

Search-based fraud is part of a much wider problem facing online platforms. It is not limited to search engines.

Redditors have repeatedly reported seeing fake cryptocurrency ads next to legitimate community discussions. YouTube has struggled with impersonation scams involving fake livestreams that promise giveaways.

Social media platforms continue to deal with scam accounts that copy official project profiles in reply threads. Telegram channels are also often targeted by people pretending to be support representatives.

Across all these cases, the pattern is the same. The same systems built to spread legitimate content can also be used to spread fraud. Advertising systems are designed to optimize for engagement and relevance. Scammers try to exploit those systems by weakening user trust. 

8. SEO poisoning and how the threat has changed

Avoiding sponsored ads may seem like an obvious solution. Unfortunately, scammers have adapted.

Search engine optimization (SEO) poisoning is the deliberate manipulation of organic search rankings so malicious pages appear near the top without paid promotion. Attackers may publish fake educational content designed to rank for popular search terms. They may also buy expired domains that already have search authority.

Others use typosquatting, which means registering domains with small spelling changes that are easy to miss at a quick glance. More advanced scams use lookalike characters from other alphabets to make fake URLs appear legitimate.

For the average user, the difference can be almost impossible to spot. As a result, even people who avoid paid ads may still land on phishing pages through normal search results.

9. Crypto security as a user experience challenge

Crypto security advice has traditionally focused on protecting sensitive information: safeguarding seed phrases, using strong passwords, enabling two-factor authentication and storing backups carefully. These recommendations still matter.

However, they are no longer enough on their own.

Many losses today do not happen through stolen credentials. They happen through deceptive experiences that are designed to look almost identical to legitimate ones. In these cases, the weak points are often simple user actions: searching, clicking, approving and trusting familiar-looking interfaces.

As a result, crypto security is becoming a user experience problem as much as a technical one. Real protection requires reducing confusion and deception at every step of the user journey, not just strengthening the final transaction screen.

10. Practical steps to reduce exposure

Simple precautions can greatly reduce a user’s exposure to search-based attacks. They also make rushed decisions less likely.

Bookmarking official websites directly, instead of searching for them each time, removes a major weak point. Sponsored links for wallets, exchanges and DeFi apps are best avoided entirely.

Users should check URLs carefully before connecting a wallet, with special attention to spelling errors and unusual characters. Links should come from verified project accounts and official documentation whenever possible.

Transaction requests should be reviewed carefully instead of approved quickly. When available, users should also use wallet tools that can simulate transactions and flag unusual permissions. Token approvals that are no longer needed should be revoked from time to time.

Above all, it is worth slowing down. Scammers deliberately exploit urgency. A few extra seconds spent checking details can be the difference between a normal interaction and an irreversible loss.

Key Highlights

• South Korea’s central bank advances digital deposit token initiative for market launch.

• Enhanced pilot phase introduces peer-to-peer transactions and expanded payment acceptance.

• Financial institutions demand improved compliance infrastructure and extended development periods.

• Government subsidy distribution through digital tokens will undergo practical evaluation.

• Parallel blockchain initiatives demonstrate Korea’s commitment to digital payment innovation.

The Bank of Korea is advancing its digital currency testing program as regulators lay groundwork for uninterrupted service and mainstream adoption. The upcoming testing cycle will integrate electronic payment platforms with traditional banking infrastructure while incorporating peer-to-peer transactions, retail payments, and clearance mechanisms. This initiative signals a strategic pivot from experimental trials to comprehensive digital financial infrastructure.

Financial Institutions Ready for Uninterrupted Digital Token Operations

Korea’s central banking authority and partner financial institutions have engaged in strategic planning to enable seamless Deposit Token operations between developmental stages. These deliberations focus on establishing necessary technological frameworks and regulatory parameters for official deployment. The Korea Federation of Banks delivered comprehensive documentation detailing these strategies to parliamentary member Lee Heon-seung.

Each token issued by commercial banking institutions represents digitized funds secured within traditional deposit accounts. The framework functions through wholesale digital currency infrastructure managed by the central monetary authority. This arrangement maintains commercial banks’ accountability for client deposits while leveraging centralized settlement support.

Initial testing phases provided select participants with digital payment applications from cooperating financial institutions. Users conducted transactions using tokenized balances at designated retail locations under controlled conditions. The evaluation primarily assessed application functionality, transaction execution, and inter-institutional settlement processes.

Enhanced Testing Phase Incorporates Peer Transactions and Extended Banking Functions

The forthcoming evaluation stage will broaden consumer and merchant participation throughout the payment network. Additional features include direct user-to-user fund transfers and authorization for banks to establish proprietary token services. Financial institutions will integrate these capabilities with fundamental account infrastructure and established settlement procedures.

The augmented initiative demands reinforced financial crime prevention protocols and enhanced transaction monitoring frameworks. Banks must implement sophisticated fraud prevention mechanisms and upgrade supporting technology infrastructure before broader implementation. Consequently, participating institutions have requested allocated funding and extended development timelines from monetary authorities.

Financial institutions contended that the enhanced evaluation constitutes a distinct initiative beyond simple pilot continuation. Direct user transfers and expanded merchant acceptance introduce substantial regulatory compliance and operational demands. The central bank subsequently modified scheduling parameters and authorized advisory services connected to commercialization strategies.

Electronic Voucher System Enables Government Disbursement Evaluation

The program will additionally assess corporate treasury transactions through electronic vouchers connected to governmental funding initiatives. According to implementation plans, officials will distribute designated electric vehicle infrastructure subsidies via tokenized payments. Businesses can subsequently receive and process governmental assistance within the participating financial network.

The second evaluation cycle will examine how tokenized funds operate within conventional banking accounts and financial ecosystems. It will also analyze whether digital token infrastructure can facilitate policy disbursements and monitored public expenditure. These capabilities could deliver enhanced transaction transparency and accelerated settlement across authorized governmental programs.

Korean financial entities are simultaneously exploring public distributed ledger systems for alternative payment solutions. Toss Bank recently formalized collaboration with the Solana Foundation encompassing cross-border remittances, settlement operations, stablecoins, and tokenized securities. This initiative remains distinct as it utilizes public blockchain infrastructure rather than the central authority’s CBDC architecture.

The central bank’s program constitutes a component of South Korea’s comprehensive examination of tokenized currency and digital settlement mechanisms. Its forthcoming phase will evaluate payments, transfers, vouchers, and commercial banking operations within a unified regulatory framework. Findings will inform policymakers regarding specifications for comprehensive digital token deployment.

Key Highlights

• Stock+ enables qualified traders to purchase authentic US equities using cryptocurrency holdings.
• Platform provides genuine share ownership with dividend rights and stock split participation.
• Digital assets are converted to USDC prior to executing US equity transactions.
• Stock+ complements rTokens within Bitget’s comprehensive Stocks 2.0 initiative.
• This rollout reinforces Bitget’s expansion into traditional financial markets via crypto integration.

Bitget has introduced Stock+, a new offering that permits qualified traders to purchase authentic US stocks and exchange-traded funds using digital currencies through a unified account interface. The platform transforms cryptocurrency holdings into USDC before transmitting equity orders via authorized brokerage partners. This initiative broadens Bitget’s approach to integrate digital currencies, tokenized securities, commodities, and traditional equities within a single ecosystem.

Stock+ Delivers Authentic Ownership with Fractional Trading Capabilities

Bitget explained that Stock+ grants ownership of actual underlying securities instead of synthetic products or derivative instruments. Traders receive cash dividend payments, gain from stock split events, and obtain shareholder privileges through compliant custody frameworks. The platform additionally accommodates purchases starting from 0.0001 shares, reducing barriers for participants with limited capital.

Transactions flow through RQD Clearing and Atomic Vaults Securities before arriving at prominent US exchange venues. Traders can execute orders during pre-market, standard, after-hours, and overnight periods, subject to market conditions and instrument availability. Bitget further offers complimentary Level 1 market information, while commission rates begin at 0.1% for each completed trade.

The system accepts incoming transfers from compatible brokerage firms, enabling traders to consolidate current equity positions with digital asset portfolios. Nevertheless, Bitget has not yet clarified if outgoing stock transfers will be accessible immediately following the product debut. Availability will vary according to regional regulations, brokerage partnerships, and client qualification standards across different territories.

Stocks 2.0 Framework Advances Bitget’s Diversified Asset Approach

Stock+ represents a component of Bitget’s broader Stocks 2.0 initiative, which focuses on conventional markets and tangible assets. Previously in June, the organization unveiled Reality, a compliant tokenization infrastructure supporting its expanding rToken product suite. These instruments deliver blockchain-powered exposure to over 500 US equities and ETFs through broker-connected frameworks.

Bitget reported that total assets under management throughout its tokenized equity offerings have surpassed $50 million following their debut. The current service now positions direct equity ownership alongside tokenized options within the identical account framework. Traders can select regulated brokerage shares or blockchain-based exposure based on their preferred ownership model.

This release positions Bitget in competition with platforms already merging cryptocurrencies with equities and additional traditional financial instruments. Kraken, Robinhood, eToro, Interactive Brokers, and Public deliver various configurations of cryptocurrency and equity market connectivity. Concurrently, numerous exchanges and protocols continue advancing tokenized securities, stablecoin settlement systems, and comprehensive multi-asset trading capabilities.

Bitget employs stablecoins as a funding intermediary while preserving regulated execution for direct equity acquisitions. This framework minimizes transfers across banks, brokerages, and cryptocurrency platforms for qualified traders already maintaining digital asset positions. Stock+ consequently advances Bitget’s mission to deliver cryptocurrency and traditional market exposure via a consolidated trading interface.

Ethereum trades at $1,733.20 after a 0.10% daily decline, with analysts now watching the $1,060 level if support at $1,731 fails. The drop coincides with $180 million in Bitcoin long liquidations hitting leveraged traders as BTC slides to $63,952, down 0.44% over 24 hours. In this environment of spot-market stress, the Gruntle ($GRUNTLE) presale has quietly accumulated $106,570 at a fixed entry price of $0.000637, positioning itself as an alternative for buyers seeking asymmetric upside without the volatility of open-market positions.

Next 100x Crypto 2026: ETH Tests $1,731 Support as Analysts Eye $1,060 Level

Ethereum’s 18% decline over the past 30 days has brought the second-largest crypto to a critical technical zone. RSI sits at 42.7, indicating neither oversold nor overbought conditions, but the price remains below both the 50-day SMA at $1,979 and the 200-day SMA at $2,357. CoinCentral’s analysis of ETH’s $1,700 support level notes that a sustained break below this zone could accelerate selling toward the $1,060 area, a level not seen since the 2023 bear market bottom.

The technical picture contrasts sharply with Gruntle’s presale mechanics. While ETH holders absorb mark-to-market losses, $GRUNTLE buyers lock in a fixed $0.000637 entry that does not fluctuate with spot volatility. The current round has raised $106,570 of its $125,664 target at 84.8% filled, with the price scheduled to rise to $0.000639 when Round 12 opens.

BTC Longs Liquidated for $180M as Traders Debate $60K Sweep

Bitcoin’s slide to $63,952 triggered $180 million in long liquidations over the past 24 hours, according to aggregated derivatives data. The wipeout hit leveraged bulls who had positioned for a breakout above $67,000, with BTC now trading 5.2% below its 20-day high of $67,420. RSI at 40.8 suggests weakening momentum, though the price remains above the recent 20-day low of $59,070.

The liquidation cascade underscores the risk embedded in leveraged spot and derivatives trading. Gruntle’s presale model, by contrast, offers no leverage and no liquidation risk. Buyers receive a fixed token allocation at the current round price, with settlement occurring at the Phase 3 DEX listing. The presale has attracted $106,570 in raised capital without the volatility that erased $180 million from overextended BTC positions.

XRP Briefly Lost $1.14 Support Before Buyers Drive Rebound

XRP dropped to $1.13 after briefly losing the $1.14 support level, marking a 1.30% decline on the day before buyers stepped in to reclaim the zone. CoinDesk’s report on XRP’s sharp rebound highlights the volatility inherent in mid-cap altcoins, where support breaks can trigger cascading stops before dip buyers emerge. XRP now sits 12.6% below its 20-day high of $1.29, with RSI at 39.9 indicating continued selling pressure.

The XRP price action illustrates the binary risk of spot trading: support either holds or it fails, and the outcome determines whether buyers profit or absorb losses. Gruntle’s presale eliminates that binary during the intake period. The $0.000637 entry holds until Round 11 closes, regardless of what XRP, ETH, or BTC do in the interim.

$GRUNTLE Presale Crosses $106,570 With Anti-Hype Positioning

Gruntle has raised $106,570 in its presale at a current price of $0.000637, with Round 11 now 84.8% filled toward its $125,664 target. The project differentiates itself through deliberate anti-hype positioning: no influencer shilling, no manufactured FOMO, and no promises of guaranteed returns. In a market saturated with meme coins promising moonshots, Gruntle’s deadpan capybara mascot and government-terminal aesthetic offer a different kind of credibility.

The project has been audited by CredShields on May 13, 2026, with the full report available via Gruntle’s CredShields audit. The ERC-20 token contract at 0x959583858090bba7e0311e4bD944311DCD827038 has been verified, and the multi-sig treasury is live. These infrastructure pieces are in place before the Phase 3 DEX listing, not after.

A $1,000 entry at the current presale price of $0.000637 acquires approximately 1,570,000 $GRUNTLE tokens. At a conservative 10x from the presale entry, that position could be worth around $10,000. The math is asymmetric: a small allocation buys a large token count while the price remains at presale entry, not post-listing market price.

Hibernation Staking Pays 5,445% APY (Variable) for Early Entrants

Hibernation Staking currently pays 5,445% APY, computed as each staker’s share of a fixed 250-million-token rewards pool. The APY is variable: it drops as more tokens stake, rewarding early entrants with a larger slice of the pool. As of the latest on-chain data, 4,591,680 tokens are already staked, and the live APY reflects that pool depth.

The staking contract at 0x780dbcbcf0eef53d03248e1561450fe87cfbd561 allows buyers to stake immediately after purchase, compounding yield while waiting for the Phase 3 DEX listing. The mechanism favors early participation: every new staker dilutes the APY for existing positions, creating a genuine incentive to enter before the pool grows larger.

Round 11 at 85% Filled With Hard Cap Mechanics

Round 11 has raised $106,570 of its $125,664 target, reaching 84.8% capacity. The round closes when the cap fills or when the round timer expires, whichever comes first. Once Round 11 closes, the price increases to $0.000639 in Round 12, a 0.3% jump that compounds across the full presale ladder. The listing price is set at $0.000713, representing an 11.9% premium to the current entry.

Check Out the Gruntle Website to Join the Presale

The presale operates alongside active peers in the current cycle. Bitcoin Hyper has raised $32.87 million from 113,462 participants at $0.013682 per token, while Pepeto has accumulated $10.30 million from 36,353 buyers at $0.00000019. Gruntle’s $106,570 raise positions it as a smaller-cap entry point in the same presale cohort, with the fixed-price mechanics and audited infrastructure already in place.

Secure your allocation before Round 11 closes.

FAQ

What is the next 100x crypto 2026 for early-stage returns?

The next 100x crypto 2026 for early-stage returns could emerge from presale-stage entries where buyers lock in fixed prices before public listings. $GRUNTLE offers a $0.000637 entry, Hibernation Staking at 5,445% APY (variable), and a CredShields audit dated May 13, 2026, with $106,570 already raised. Early presale positions may capture asymmetric upside if the token lists at a premium, though all forward-looking returns remain speculative. Details at gruntle.io.

What makes a presale a candidate for the next crypto to explode?

A presale could become a candidate for the next crypto to explode when it combines audited infrastructure, transparent tokenomics, and a clear listing roadmap. $GRUNTLE meets these markers with a verified ERC-20 contract, a 250-million-token staking pool paying 5,445% APY (variable), and Phase 3 DEX listing plans. The current $0.000637 entry holds until Round 11 closes at $125,664 raised.

What makes $GRUNTLE different from other meme coin presales?

$GRUNTLE differentiates through anti-hype positioning: no influencer shilling, no manufactured FOMO, and honest communication about what the token is. The project was audited by CredShields on May 13, 2026, and the presale has raised $106,570 at $0.000637 with Hibernation Staking paying 5,445% APY (variable, decays as more stake). The deadpan capybara mascot reflects the brand’s deliberately unbothered identity.

This article is for informational purposes only and does not constitute financial advice. $GRUNTLE is a meme coin. Cryptocurrency investments carry significant risk. Always conduct your own research before investing.

Disclaimer: This is a Press Release provided by a third party who is responsible for the content. Please conduct your own research before taking any action based on the content.

“Overall this points to a stabilizing but still fragile ETF demand backdrop, where investors are no longer accelerating exits but are gradually repositioning capital, providing a potential floor to downside,” the firm said.

The other notable dynamic is the decoupling of the U.S. two-year Treasury yield, which is sensitive to Fed interest rate expectations, and WTI crude oil futures. While oil prices have collapsed, the two-year yield has strengthened, hovering at 4.21% as of this writing, the highest since February 2025. (Check the Daily Signal.)

The decoupling indicates that oil and geopolitical headwinds for risk assets have been replaced by Fed rate-hike expectations. It’s possible markets expect the second-order effects of the March oil-price spike to keep inflation higher in the near term, raising the likelihood of interest-rate increases.

The Fed’s preferred inflation gauge, the core PCE, is expected to confirm the trend. According to FactSet, it is forecast to have increased 0.37% on the month, lifting the 12-month rate to 3.4%, which would be the highest since May 2024.

Overall, the slower, yet still bleeding ETFs and hawkish hints from bond yields suggest lower odds of a convincing BTC price recovery in the short term.

And there’s also what Strategy, the largest publicly listed BTC holder, does to address concerns about the price volatility of its STRC preferred stock. Stay alert!

Prolific MEV “sandwich” bot JaredFromSubway.eth lost a total of $7.5 million worth of crypto over the weekend after being lured into a trap over almost one hundred blocks.

In a dramatic case of on-chain karma, the plot to relieve the bot of what many see as its ill-gotten gains involved fake tokens, small wins and an equally dramatic sting.

Blockchain investigator Specter flagged the suspicious transaction, which saw approximately 1,475 WETH ($2.6 million), $2.9 million USDC, and $2 million USDT drained from JaredFromSubway.eth’s bot.

Read more: JaredFromSubway.eth sandwich attacked Vitalik Buterin

The ‘victim’

The victim address, labelled “jaredfromsubway: MEV Bot 2” on block explorer Etherscan, has been active since August 2024 and is the operator’s second iteration.

Between the two bots, and 6.4 million transactions, the operator has made millions of dollars by “sandwiching” on-chain trades.

This process involves scanning the network’s mempool of pending transactions before front-running and back-running user trades. The front-run manipulates swap prices, while the back-run makes a profit off the difference, paying block builders a tip to be included at the right position in the block.

As transaction fees on Ethereum have dropped, sandwichers often target increasingly small wins, such as JaredFromSubway’s attack on Ethereum co-founder Vitalik Buterin last month.

The bot operator’s choice of name is a dark nod to the popular sandwich shop’s erstwhile mascot Jared Fogle, who was later discovered to be a sex offender.

Read more: Explained: How JaredFromSubway.eth still sandwich attacks victims

The campaign

The attacker specifically targeted JaredFromSubway’s bot, luring it in with small, profitable sandwich attacks on fake attacker-created token pairs.

A report from Yearn developer Banteg describes how, over the course of 97 blocks, the bot was offered “small real-token profits,” on “profitable fake-DEX arbitrage” opportunities.

However, during the transactions, the bot contract inadvertently “approved attacker-controlled child contracts to spend real WETH, USDC, and USDT,” which were not consumed during the sandwiches, nor revoked afterwards.

The attacker was then able to harvest the pre-approved tokens in the final drain transaction.

Read more: Aztec Network hit by second hack this week as escapeHatch drained of $2M

The aftermath

Taking advantage of the news, recently-renamed X handle “jaredsmev” made various scam bounty offers of $1 million to $7.5 million, citing the erroneous, but widely reported total loss of $15 million.

Cointelegraph even reposted one of the scammer’s offers to its 2.9 million X followers, before deleting.

Read more: Cointelegraph says Bitcoin ETF approved despite no proof

In an on-chain transaction from JaredFromSubway.eth, the bot’s real operator sent an input data message to the attacker, with a seemingly genuine bounty offer.

“Well played,” begins the message, before requesting the return of 2150 ETH, equivalent to approximately 50% of the stolen funds, in the next 48 hours.

“Otherwise we will pursue all available legal and law-enforcement remedies,” it threatens.

Other users have reached out to the attacker on-chain, claiming to be victims of JaredFromSubway’s MEV operations, and requesting reimbursement of their supposed losses.

One called the attacker “our Robin Hood in a White Hat.” Others were less subtle.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.