The $25M MEV Bot Exploit Explained: How Sandwich Bots Got Unbundled

By Merunas Grincalaitis, founder of MEV DAO and a developer who builds MEV, sniping and trading bots on Ethereum. Last updated: October 2026.

TL;DR: The biggest MEV bot exploit on Ethereum happened on April 3, 2023: a malicious validator baited sandwich bots with juicy swaps, tricked the ultra sound relay into revealing their bundles by signing an invalid block header, then proposed its own block that broke the sandwiches apart. Flashbots put the loss at about $20M; US prosecutors say about $25M. Relays were patched within hours. Two brothers, Anton and James Peraire-Bueno, were charged with wire fraud, and their November 2025 trial ended in a mistrial.

I build bots that live inside this exact pipeline, so this is the incident I come back to most. Nobody's Solidity was broken. It's a story about trust: sandwich bots trusted that their bundles were atomic and that a relay would never show their transactions to anyone early. Both assumptions failed in the same 12-second slot. Here's how the MEV bot exploit worked, what changed, and what searchers should take from it.

What was the $25M MEV bot exploit?

It was an attack on the MEV-Boost block auction in which a validator stole funds from sandwich bots by seeing their bundles early and rearranging them. It happened in slot 6137846, late on April 2 / early April 3, 2023 (UTC), according to the Flashbots post-mortem.

Two numbers float around. Flashbots and the relay teams estimated "~$20M" lost by multiple sandwich bots. The US Department of Justice, in its May 2024 press release, says "approximately $25 million worth of cryptocurrency within approximately 12 seconds." The gap is mostly about which tokens you count and at what price.

To follow it you need three quick definitions:

A sandwich bot is a searcher bot that buys a token right before a victim's swap and sells right after it, profiting from the price move the victim causes. (Full breakdown in my sandwich attack guide.)
A bundle is an ordered group of transactions a searcher sends privately to a block builder, meant to land together, in order, or not at all. See Flashbots bundles explained.
A relay is the MEV-Boost middleman that shows the validator only a block's header and bid, and reveals the full block once the validator signs. More in What Is MEV-Boost?

How did the attack work, step by step?

The attacker became a block proposer, posted bait swaps that sandwich bots couldn't resist, got the relay to leak the bots' bundles, and then built a different block where the bait was reversed. Here's the sequence from the post-mortem, in plain terms.

Set up a validator. On March 16, 2023, the attacker registered a validator, funded with ETH withdrawn from Aztec, and waited for it to be picked as a block proposer. Prosecutors later said the brothers created more than a dozen validators, per DL News.
Post the bait. Around block 16964664, the attacker sent swaps to the public mempool with effectively unlimited slippage on pools with real liquidity. To a sandwich bot that looks like free money.
The bots take it. Several sandwich bots saw the bait and sent bundles to the builder builder0x69. Each bundle was "buy, victim swap, sell".
The block goes to the relay. builder0x69 built a block containing those bundles and submitted it to the ultra sound relay.
The invalid header trick. When the attacker's slot came up, it asked the relay for the best header, then signed a header with the state root and parent root set to zero. That header was signed correctly but invalid.
The leak. The relay tried to publish the block; its beacon nodes rejected it as invalid. The bug: the relay still returned the full block body to the proposer.
The swap. Now the attacker could see every transaction in the bots' bundles. It built its own block for the same slot, keeping the bots' front-run buys but replacing what followed, so the bots ended up holding tokens from illiquid pools while the attacker walked away with the valuable side. The DOJ describes it as gaining access to "pending private transactions" and using that access "to alter certain transactions".
No race to lose. Normally a modified block has to race the relay's block, which has a head start. Here the relay's version was never published, so the attacker's block was uncontested.

Step	What the bots assumed	What actually happened
Bait swap in mempool	A careless trader to sandwich	A trade planted by the proposer
Bundle sent to builder	Private until the block is final	Visible to the proposer after a bad signature
"All or nothing" bundle	Front-run and back-run land together	Front-run landed, the rest was replaced
Relay publishes the block	The relay's block wins the slot	The relay's block never got published

The whole thing fits in one slot, which is where the "12 seconds" comes from.

Why couldn't the sandwich bots protect themselves?

Because their protection was the bundle itself, and the bundle only works if every party between the bot and the chain plays by the rules. A sandwich bot sends its buy because it trusts the sell will follow in the same block. That's the whole point of the Flashbots bundle model.

The attacker was the one party above builders and relays: the proposer. Once a proposer can see the block and is willing to equivocate (sign two different blocks for the same slot), the "atomic" guarantee is gone. The bots took counterparty risk they didn't price in.

The bait also worked because the bots chased huge, sloppy swaps with a lot of capital. Traps built for MEV bots are often called "salmonella", after the 2021 Salmonella repo that poisoned generalized front-runners with a token that behaved differently for them. This attack was the infrastructure-level version of that idea.

How did Flashbots and the relays fix it?

Relays now only release a block to the proposer after they've successfully published it to the network, and they stop handing out blocks late in the slot. The fix shipped in mev-boost-relay v1.0.0-alpha3, according to the Flashbots transparency report.

The timeline from the post-mortem (all times UTC, April 3, 2023):

6:11am: the first public tweet about the drained bots.
7:47am: the ultra sound relay disables itself.
9:35am: the Flashbots relay is disabled.
10:06am: a patch is released after testing on Sepolia and Goerli.
10:53am: relays begin deploying the patch on mainnet.

Follow-ups:

A 3-second cutoff. The teams found a related attack where a proposer asks for the block too late in its slot, misses the slot on purpose and still learns the contents. Relays added a cutoff after which they won't return a block. It started at 2 seconds and went to 3 seconds after honest validators reported missed slots.
Validate before broadcast. Relays patched their consensus nodes to validate blocks before broadcasting them.
No early getPayload. On April 21, the attacker (who asked to be called "low carb crusader") emailed Justin Drake, samczsun and Robert Miller and disclosed another trick: calling getPayload just before the slot started to peek early. Flashbots patched that too and said its logs showed the trick was never used in production.

None of this changes the basic fact that relays are trusted parties. That's one of the main arguments for building proposer-builder separation into the protocol itself.

Who was charged, and what happened in court?

In May 2024 the DOJ charged MIT-educated brothers Anton and James Peraire-Bueno with wire fraud, conspiracy to commit wire fraud and conspiracy to commit money laundering; their trial ended in a mistrial in November 2025. These are allegations only, and the brothers are presumed innocent.

The indictment press release alleges months of planning, study of the victim traders' behavior, and shell companies and foreign exchanges to hide the proceeds. In July 2025 the judge refused to dismiss the fraud charges, but threw out a separate receiving-stolen-property count.

The trial started in October 2025. On November 7, 2025 the jury said it was deadlocked and Judge Jessica Clarke declared a mistrial (court order). Prosecutors asked for a retrial. The defense filed a motion for acquittal, comparing the case to Avraham Eisenberg's Mango Markets acquittal, per DL News. At a March 2026 hearing the judge said she'd rule on that motion before scheduling anything, and that any retrial wouldn't begin before November 2026. In a joint letter later that month the defense asked for a mid-2027 window if a second trial happens. As of the latest public reporting I could find, I haven't seen a ruling, so check the docket before you quote an outcome.

The legal question is simple to state: is exploiting how a protocol behaves fraud, or is it "code is law"? The prosecution leans on the false signature, treating a deliberately invalid signed header as a lie told to get the block contents. I go deeper on where the legal lines are for ordinary bots in Are MEV Bots Legal?

What should MEV searchers learn from it?

Treat every party between your bot and the chain as a counterparty, and size your risk on the assumption that one of them will misbehave. What I took from it:

Never assume "atomic" means "safe". Bundles protect you against other searchers, not against the proposer. If a strategy only makes sense when all legs land together, cap how much a single leg can lose.
Be suspicious of perfect bait. Huge trades with silly slippage on thin pools are exactly what a trap looks like. Filter for them, or at least size down.
Simulate against the worst ordering. When I test on a mainnet fork with Anvil, I check what happens if only the first leg executes.
Know where your flow goes. Which builders and relays end up with your bundles matters. Concentrating flow in one pipe concentrates the risk too.
Prefer strategies with less exposure. Backruns only go after a transaction and don't need a front-run leg sitting in the open. It's one reason I point beginners to backrunning instead of sandwiching.

Frequently asked questions

How much was stolen in the MEV-Boost relay exploit?

Flashbots estimated about $20M lost by multiple sandwich bots; the US Department of Justice says about $25 million. The gap mostly comes from which tokens are counted and how they're priced.

What is an unbundling attack?

It's when someone who can see a bundle before it's final takes it apart, keeping some transactions and dropping or reordering others. In April 2023 the attacker kept the bots' buys and replaced the rest.

Was this a Flashbots hack?

Not exactly. The bug was in the open-source mev-boost-relay code that Flashbots maintains, and it was exploited through the ultra sound relay. Flashbots' own systems weren't breached, but most relays shared the vulnerable code.

Is the MEV-Boost relay bug still exploitable?

That specific bug isn't. Relays now publish the block before returning it, and they won't return blocks late in the slot. Relays are still trusted parties, though, so similar risks can't be ruled out.

Were the Peraire-Bueno brothers convicted?

No. Their 2025 trial ended in a mistrial after the jury deadlocked. Prosecutors sought a retrial and the defense moved for acquittal; check the court docket for the latest status.

Can a validator still front-run my bundle?

A proposer who sees your block and is willing to equivocate can still try, and equivocating risks slashing. Relay fixes made this much harder in practice, but the trust problem is the reason for in-protocol proposer-builder separation research.

This exploit is the reason I write threat models before I write strategy code. If you're building a searcher and want someone to stress-test its assumptions, the custom MEV bot development page explains how I work, or you can message me on Telegram.