How Does a Solana Bot Exploit MEV for $30M Profit?

June 17, 2024

Image Credit: Unsplash

How Does a Solana Bot Exploit MEV for $30M Profit?

In the endlessly evolving world of cryptocurrencies, an audacious Solana-based bot known as “arsc” has swiftly advanced to notoriety. This ingenious program has leveraged a technique called “sandwich attack” to pilfer approximately $30 million from Solana users within just two months. The operation centers on a cunning exploitation of maximal extractable value (MEV), a concept referring to the profit a miner can make through the inclusion, exclusion, or reordering of transactions within a blockchain block. Bots like “arsc” exploit this by essentially cutting in line. They strategically position a user’s transaction amidst two they control, facilitating the purchase of crypto at lower than market prices and the subsequent immediate sale at a higher rate, all within the span of a single block.

This sophisticated scheme has been traced back to a few key wallets, including one particularly large cache purportedly used for cold storage. Housing over $19 million, its assets are predominantly in Solana’s SOL and Circle’s USD Coin (USDC). Besides cold storage, there’s another hive of activity – a wallet engaging continuously in decentralized finance (DeFi) processes, shrewdly converting SOL to USDC. The ceaseless churn of these conversions is part of a grander strategy to veil the bot’s manipulations from the wary eyes of researchers and users alike.

Tracking the Trails of MEV Bots

In the dynamic panorama of digital currencies, a Solana-based bot nicknamed “arsc” has surged to infamy. It masterfully employs a “sandwich attack” to usurp around $30 million from users on the Solana network over a mere two months. By exploiting a niche known as maximal extractable value (MEV), it profits by manipulating the sequence of transactions in a blockchain block.

“arsc” intrudes into the transaction queue, sandwiching an unsuspecting user’s trade between its own. This ploy allows the bot to buy cryptocurrency cheaply and flip it immediately at a higher price in one block, making an instant profit.

Investigators have linked the scam to several wallets, with one holding a staggering $19 million – purportedly a cold storage trove, rich in Solana’s SOL and USD Coin (USDC) from Circle. Another wallet under scrutiny shows relentless DeFi activity, constantly trading SOL for USDC. This frenzy masks the bot’s activities, keeping the operation under the radar of researchers and Solana participants.

Explore more

Is UiPath Poised for Growth Amid Institutional Shifts?

October 21, 2026

CEO Daniel Dines recently sold 1,250,000 shares of UiPath at an average price of $13.44, representing a 3.97% reduction in his direct holdings during a period of institutional rebalancing. This transaction highlights a significant moment for the company as it navigates a complex financial landscape where leadership actions are scrutinized alongside broader market shifts. While the sale of such a

How Will Connecticut’s New Law Change Workplace Monitoring?

October 21, 2026

Existing prohibitions against electronic surveillance in restrooms and locker rooms remain unchanged under the new legislative framework passed in Connecticut. The signing of Public Act No. 26-73 by Governor Ned Lamont signals a transformative shift in the relationship between employers and staff members across the state. This legislation addresses the rapid integration of intrusive technologies like smart glasses and biometric

California Education Data Breach Exposes Millions of Records

October 21, 2026

While financial identifiers like Social Security numbers remained secure, the theft of English-learner status and Section 504 designations has created a new category of privacy risk. This historic data security failure involving the California Department of Education and the Educational Testing Service represents an unprecedented exposure of student information in the mid-2020s. The breach has compromised the personal details of

Busan Police Arrest 101 in Major Global Phishing Bust

October 21, 2026

Chinese nationals orchestrated a large-scale smuggling ring that brought hundreds of illegal telecommunications devices into the country under the guise of hardware components. These sophisticated “relay machines” were designed to intercept international voice-over-IP signals and re-broadcast them as local South Korean mobile numbers, specifically those utilizing the “010” prefix. By weaponizing this technology, the criminal syndicate managed to bypass the

How Can Fake Google Meet Sites Bypass Your 2FA Security?

October 21, 2026

If a user suspects they have interacted with a fraudulent page, they must immediately terminate all active sessions and review their account for unauthorized device logins. The modern digital workplace relies heavily on the implicit trust we place in ubiquitous communication platforms, a psychological shortcut that sophisticated threat actors are now exploiting with surgical precision. By crafting a meticulous replica