TLDR

• Vitalik Buterin’s XDB token swap triggered a sandwich attack from the JaredfromSubway MEV bot on Ethereum.
• The bot executed more than $1 million in trades before and after Buterin’s transaction confirmed.
• Blockchain data showed the sandwich attack happened in Ethereum block 24993038 on April 30.
• JaredfromSubway used SushiSwap and Uniswap V2 pools to manipulate XDB prices during the trade.
• Reports showed the bot likely lost money after paying more than $5 in gas fees.

---

Ethereum mempool activity exposed another sandwich attack involving Vitalik Buterin earlier this week. Blockchain data showed the JaredfromSubway bot targeted Buterin’s small XDB token trade on April 30. The transaction triggered more than $1 million in temporary trading volume across decentralized exchanges.

Vitalik Buterin Trade Triggered Automated MEV Activity

Etherscan data showed Buterin swapped 26,544 XDB tokens for 0.00197 ETH during block 24993038. The transaction carried an estimated value between $3.86 and $4.56. However, the JaredfromSubway bot detected the pending trade before block confirmation.

The bot then executed about $1.14 million in wrapped Ether transactions through SushiSwap and Uniswap V2. Those trades temporarily changed XDB liquidity prices before Buterin’s transaction completed. Afterward, the bot reversed the positions and captured a small spread from the movement.

CoinDesk analysis showed the bot likely earned only a few cents from the sequence. Gas costs reportedly reached $5.14 during the operation. Therefore, the bot appeared to lose money on the isolated transaction.

Blockchain records still showed the bot completed the full sandwich sequence despite the limited profit opportunity. Analysts said the behavior reflected automated scanning across Ethereum’s public mempool. The system searched continuously for transactions that matched preset trading conditions.

A sandwich attack places trades before and after another user’s pending transaction. The strategy raises the asset price before execution and sells immediately afterward. As a result, victims receive weaker execution prices during swaps.

JaredfromSubway Continues Expanding Ethereum MEV Operations

JaredfromSubway gained attention during the 2023 meme coin trading surge on Ethereum. The bot targeted traders dealing with tokens including PEPE and WOJAK. During April 2023, the bot briefly generated 7% of Ethereum gas usage.

Reports estimated the operation extracted more than $7 million from trading activity over hundreds of thousands of transactions. Developers and researchers tracked the wallet through several blockchain monitoring tools. The bot also survived contract upgrades and filtering attempts from builders.

Ethereum developers continue discussing methods to reduce toxic maximal extractable value activity. Buterin recently promoted encrypted mempools within Ethereum’s developing 2026 roadmap. He argued public mempools expose regular traders to hidden trading costs.

MEV refers to profits earned through transaction ordering on blockchain networks. Bots monitor pending transactions and insert trades before confirmation. Sandwich attacks currently represent about 51% of Ethereum MEV activity.

Current estimates placed cumulative Ethereum MEV extraction above $1.2 billion. Meanwhile, developers continued testing systems designed to limit front-running opportunities. Blockchain records from April 30 still showed JaredfromSubway executing the sandwich around Buterin’s transaction.

Political action committees (PACs) affiliated with the cryptocurrency company-backed Fairshake reported spending millions of dollars to support candidates in five races, with less than six months until US voters decide on their representatives in Congress.

According to filings with the Federal Election Commission this week, the Protect Progress PAC reported about a combined $1.6 million in expenditures for Jasmine Clark and Christian Menefee, Democrats running to represent Georgia’s 13th Congressional district and Texas’ 18th district, respectively. 

The reported media buys came before Clark will face a May 19 Democratic primary and Menefee a May 26 runoff against Representative Al Green, who is running for a 12th term in office. Protect Progress claimed that Green was “actively hostile towards a growing Texas crypto community,” pledging to spend $1.5 million to oppose his reelection to Congress.

Protect Progress, a Fairshake affiliate, typically focuses on Democratic candidates, while another affiliate, Defend American Jobs, supports Republicans. The Defend American Jobs PAC similarly reported spending $5.6 million on candidates in Georgia’s 1st and 14th districts, Nebraska’s 3rd district and US Senate races in Alabama and Kentucky. All four US states are scheduled to hold May primaries.

Related: Americans distrust crypto, AI as industry super PACs flood midterms, poll finds

Among Defend American Jobs’ expenditures, Andy Barr, running for the US Senate in Kentucky and currently a US House representative for the state’s 6th district, received the most support, with more than $3.5 million in media. Barr has made many public statements favoring pro-crypto policies while in Congress, and voted in favor of legislation, including the GENIUS Act and CLARITY Act.

Source: Andy Barr

Fairshake, which reported holding $193 million as of January, has already spent millions of dollars in an attempt to influence voters through the media in the 2026 primaries. The Defend American Jobs PAC spent about $514,000 on advertising supporting Republican James Baird’s reelection in Indiana, and poured millions into media for Texas and Illinois races this year.

Crypto market structure bill could impact candidates’ midterm chances

For many crypto-supporting lawmakers and industry leaders, the progress of a digital asset market structure bill, called the CLARITY Act, could prove to be a litmus test for the 2026 midterm elections. Fairshake and its affiliates spent more than $130 million on media to support or oppose candidates in 2024, potentially influencing voters and changing the makeup of the current Congress, which will decide crypto-related laws.

“I do think it is critically important that every single member of Congress have a position on crypto, it’s part of their election campaign and their platform, and voters are going to be paying attention to this,” Cody Carbone, CEO of crypto advocacy organization The Digital Chamber, told Cointelegraph.

Last week, lawmakers in the US Senate announced a compromise on stablecoin yield that could allow the CLARITY Act to move forward for markup in the Senate Banking Committee, whose approval is necessary before a full floor vote. As of Thursday, the committee had not scheduled a markup on the bill.

Magazine: Guide to the top and emerging global crypto hubs: Mid-2026

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

MEV-focused extraction bot JaredFromSubway.eth front- and back-ran an Ethereum trade by Vitalik Buterin, getting away with about two-thousandths of an ether (ETH).

Ethereum founder Buterin was selling a token airdrop, DigitalBits, when he fell victim to the garden-variety sandwich attack.

The name “JaredFromSubway” refers to Jared Fogle who lost nearly 250 pounds while earning a TV sponsorship from Subway. After his weight loss fame faded, however, the world learned of Fogle’s sexual misconduct involving minors, including a criminal conviction.

He remains imprisoned with an expected release date of 2029.

Crypto, of course, has a dark sense of humor, and despite his legal troubles, someone decided to name a maximum extractable value (MEV)-focused extraction bot after him. Fogle, who has limited internet access in prison, doesn’t control the bot.

The trader bearing an ENS name with Fogle’s brand extracted value from Buterin’s transaction inside Ethereum block 24993038.

Read more: Your L2 transaction fees are higher because of MEV spam, report

Another sandwich attack by JaredFromSubway.eth

Buterin routed 26,544 DigitalBits (XDB) tokens through the Uniswap V2 router with his slippage parameter amountOutMin set to zero. That setting accepted any non-zero output.

Advertisement

Buterin received 0.00197 ETH, worth a little under $5 at the time.

JaredFromSubway.eth, watching the public mempool, noticed Buterin’s unprotected swap and inserted itself onto both sides of his transaction.

In the position immediately before Buterin, the bot dumped a pile of XDB into the same Uniswap V2 pool. That depressed the exchange rate Buterin would receive.

In the position immediately after, it bought XDB back at the depressed price and rotated the inventory through a third liquidity pool to close the loop.

Advertisement

After gas fees, Jared gained nothing except the satisfaction of making a priceless joke at Buterin’s expense.

The punchline is that a sandwich bot on Ethereum — named after the world’s most famous sandwich spokesperson — still tricked a careless Buterin out of fees on his own blockchain.

If Vitalik can get sandwiched, so can you.

Good excuse to learn a bit about MEV, mempools, and how to stop donating money to bots.

This is not just about one funny tx.

Advertisement

Although, yes, it is funny.

It is about the fact that Ethereum trading happens inside an adversarial… https://t.co/GcWVXqsVKW

— zeugh.eth (@theZeugh) May 7, 2026

Read more: Vitalik Buterin’s $1B crypto donation to India will be worth just $400M

Advertisement

Buterin suffered the sandwich attack because his swap order carelessly accepted any output. Setting amountOutMin to zero was Uniswap’s maximally permissive setting.

In essence, Buterin told his order router to fill his trade no matter how badly the price moved based on his supply.

MEV bots scanning Ethereum’s mempool salivate for exactly that type of laziness.

Buterin has a habit of dumping unsolicited airdrops and donating the proceeds.

Advertisement

Because almost all of his personal net worth derives from his pre-mined allocation of ETH, he’s happy to donate extra coins that he receives. In this case, his donation went to an unintended recipient.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

MIAMI – Coinbax won the $20,000 grand prize at Consensus Miami’s PitchFest after pitching a system designed to help banks and financial firms manage compliance for stablecoin payments.

The company, founded by former Jack Henry executive Peter Glyman, builds programmable escrow infrastructure that adds controls to wallet-to-wallet crypto transactions. The software is meant to reduce the risks financial institutions face when moving funds onchain.

“Banks want to use stablecoins for payments, but they need to get their compliance people comfortable with the idea of moving money onchain,” Glyman said during his presentation.

He described a future where “wallet addresses [are] associated with every bank account,” with transactions moving between banks, fintech firms and self-custody wallets. In that environment, he argued, compliance checks need to happen directly onchain rather than only through traditional banking intermediaries.

Coinbax uses smart contracts to hold funds in escrow while third-party services verify identity, sanctions screening and transaction risk. Funds settle only after conditions are met.

“We provide a trust layer,” Glyman said. “We provide programmable escrow that adds the control layer to these payments.”

The startup launched in October, closed a seed round in December and is already live on Base mainnet, according to Glyman. He said the company is working with banks, custody firms and wallet providers on pilot programs.

Second place went to Tashi, a decentralized infrastructure project focused on coordinating and managing AI systems across distributed networks.

Crypto traders are keeping their fingers crossed for another global pandemic amid predictions that an outbreak of hantavirus from a cruise ship could spur on a so-called “memecoin supercycle.”

X user “@jeetassassin,” who features a badge of the Solana-based crypto exchange Moonshot on their account, claimed that the hantavirus “will spark another memecoin supercycle.”

Hours later, Moonshot claimed that it had “verified” Pump Fun-created token hantavirus (HANTA), which features an AI-generated image of a virus and a rat, on its site. 

Read more: Your $1,200 COVID stimulus could be worth $14,700 in bitcoin

Nansen CEO Alex Svanevik claimed that during the coronavirus (COVID-19) pandemic in 2020, it was the year of “DeFi summer.” Now he’s proposing that the hantavirus could herald an “agentic summer.”

Indeed, various other crypto users on X have noted that memecoin traders are praying for a potential pandemic so that their hantavirus-themed crypto holdings “go 100x.”

One user noted, “memecoin traders want the world to go into a full on global pandemic so there $500 in ‘handavirus’ coin goes up.”

Another memecoin trader brandishing a Pump Fun-affiliated badge asked, “What if the Hantavirus shuts down everything and we enter a memecoin supercycle.”

Read more: Paranoid anti-vaxxers are buying fake COVID passes for bitcoin

The display of apathy on show from a lot of memecoin traders shows their indifference to global issues as they participate in an addictive, online lifestyle of gambling with cryptocurrencies. 

As one trader put it, “If a pandemic is what it takes to bring traders & vol back then so be it.”

Another claimed that, despite not wanting a pandemic to push the world into lockdown again, “If it somehow does end up spreading and gets COVID-level exposure, crypto volume would probably go absolutely crazy.”

Sorry memecoin traders, hantavirus doesn’t spread like COVID-19

Hantavirus is the name given to a group of various viruses that are carried by rodents. In this case, the Andes hantavirus was detected on a cruise ship departing Argentina last month. 

The virus is reported to have infected five passengers, and is suspected to have spread to three more. Three passengers have died as a result, and those suspected of being infected are being treated and isolated.  

Despite memecoin traders’ eagerness for a global pandemic, the World Health Organization (WHO) has stressed that the Andes hantavirus is not as contagious as COVID-19, and that the risk to the public is low.  

WHO infectious disease epidemiologist Dr. Maria van Kerkhove said at a conference today that, “This is not Covid, this is not influenza, it spreads very, very differently.”

Hantavirus latest: The UN World Health Organization (WHO) says human-to-human transmission aboard cruise ship in Atlantic Ocean cannot be ruled out, although it is rare. Seven of 147 passengers and crew have fallen ill and three have died. https://t.co/mY3ZwGQGsW pic.twitter.com/VhCVHzAvk6

— UN News (@UN_News_Centre) May 5, 2026

The health body stressed that the virus requires intimate, prolonged contact with people in order to spread.

The Andes hantavirus has spread before, but never reached pandemic status. It’s also not a new strain of virus like COVID-19 that required an international effort to produce a vaccine. 

However, the hantavirus itself is still quite deadly and can cause the respiratory disease hantavirus cardiopulmonary syndrome which has a mortality rate of up to 50%. 

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.

Bitcoin (BTC) price dropped to $79,800 on Thursday after being rejected at a key dynamic resistance level. The pullback occurred despite the weekly spot Bitcoin exchange-traded fund (ETF) inflows surging past $1 billion for the first time since January, but technical data suggests the correction may be short-lived. 

Bearish divergences point to where BTC price may go

Bitcoin’s dip below $80,000 came amid a bearish divergence in the relative strength index (RSI) on the one-hour and four-hour charts. A bearish divergence occurs when BTC forms higher highs while the RSI weakens across lower timeframes, signaling fading buying momentum during a rally.

BTC/USDT, four-hour chart. Source: Cointelegraph/TradingView

A hold above the weekly open at $78,500 could stabilize the short-term price action. The key technical support range remains between $76,000 and $78,000, where the daily fair value gap (FVG) aligns with Bitcoin’s 200-day exponential moving average (EMA). If the correction continues, BTC could retest the FVG zone before attempting another rebound above its recent high at $82,800.

A fair value gap marks an area where a sharp price movement previously occurred with limited trading activity, leaving an imbalance that often becomes a liquidity zone during retracements.

Crypto trader Jelle said the “200-day MA/EMA cluster” was acting as resistance, while also identifying $78,000 as the first major support area. According to Jelle, a 200-day moving average retest could allow Bitcoin to retest higher price targets.

Meanwhile, crypto trader Killa XBT identified the $76,300 to $74,700 range as a deeper support zone if selling pressure continues. The trader pointed to the weekly open near $78,500 as the main short-term level that bulls are attempting to defend. 

BTC one-day chart analysis by Killa. Source: X

Related: Bitcoin analysts say this level must break for BTC price to confirm bottom

Can spot ETF inflows offset price weakness?

Spot Bitcoin ETF demand strengthened sharply this week. Net inflows reached $1.05 billion, marking the strongest weekly intake since the third week of January. A positive close on Friday would confirm the largest weekly ETF inflow return in nearly four months.

Spot BTC ETF net inflows. Source: SoSoValue

Meanwhile, Swissblock data shows that the Bitcoin Risk Index has reset to near zero, while ETF net flows turned positive again at roughly 3,000 BTC. Historically, elevated risk readings aligned with the ETF outflows and heavier selling pressure across the market. 

Risk index and BTC ETF net flows. Source: Swissblock/X

The resets into the low-risk zone often coincided with renewed accumulation near the major support clusters. The analysis added, 

“That synchronization is still in place. Even when the Risk Index ticked slightly higher last week, ETF selling appeared briefly, but accumulation quickly resumed. That tells us ETF demand is absorbing selling pressure. This remains a flow-driven breakout.”

Related: Bitcoin market dominance moves above 61%: Will altcoins follow?

This article is produced in accordance with Cointelegraph’s Editorial Policy and is intended for informational purposes only. It does not constitute investment advice or recommendations. All investments and trades carry risk; readers are encouraged to conduct independent research.

Public blockchains make transactions transparent enough to trace, audit and police, but that visibility can come at the expense of user privacy. Traditional compliance systems often address accountability by identifying people, but that can undermine one of crypto’s original promises: the ability to transact without exposing personal identity by default.

According to panelists at CoinDesk’s Consensus Miami conference earlier this week, those tensions are increasingly solvable through an onchain “intelligence layer” that combines hybrid blockchain architecture with wallet-address-level monitoring.The idea is to split the work across different parts of the system. Private permissioned networks can give institutions the accountability and credibility they need, while public permissionless chains can provide liquidity, and blockchain-forensics tools can help platforms screen transactions at the wallet-address level without automatically tying every user to a real-world identity.

Rajeev Bamra, global head of strategy for digital economy at Moody’s Ratings, said the conventional intelligence layer answers three questions: “Who is it? What are they doing? And can I trust the record?” Those have been addressed in traditional finance by banks, custodians, clearinghouses and credit-rating agencies, he said.

Bamra estimated the institutional digital-finance market at roughly $35 billion today, against more than $200 trillion in annual clearing-house flows in conventional finance, with growth of “over 100 or 150%” in the past 18 months. Blockchain architecture, he predicted, will not be uniformly public or private but a hybrid. “Private permission networks are going to offer the accountability, the credibility aspect,” he said, while “the public permissionless brings the liquidity which the private permissions don’t.”

Pauline Shangett, chief strategy officer at the non-custodial exchange ChangeNOW, firmly sided with the user-side argument. “Bitcoin at its core, at its origin was a semi-anonymous digital cash,” she said.

ChangeNOW, which does not enforce KYC by default, works with AML providers and blockchain forensics firms to monitor flows at the wallet-address level. “All of this blockchain forensics infrastructure allows us to not map people who are passing funds through our system, but instead map their addresses,” Shangett said.

When law-enforcement agencies come to ChangeNOW, Shangett said, the company provides transaction data without doxing the person behind the transaction. She said that compromise allows the platform to provide registration-free swaps while still maintaining internal accounting systems and working with authorities when illegitimate funds move through the service.

On regulation, Bamra said cross-border frameworks like the European Union’s Markets in Crypto-Assets Regulation and the U.S. GENIUS Act ask the same fundamental questions about asset quality, segregation and liability, but diverge sharply at the specifications layer. “We think there is regulatory convergence in intention, but there’s fragmentation in reality or in execution,” he said.

Shangett ended with a regulatory-liability framing, which she suggested cuts to the heart of where responsibility should actually sit.

“The agents who should be held liable for the regulatory frameworks and the adoption thereof are agents who are dealing with emission and not transmission,” she said.