How Does a Solana Bot Exploit MEV for $30M Profit?

In the endlessly evolving world of cryptocurrencies, an audacious Solana-based bot known as “arsc” has swiftly advanced to notoriety. This ingenious program has leveraged a technique called “sandwich attack” to pilfer approximately $30 million from Solana users within just two months. The operation centers on a cunning exploitation of maximal extractable value (MEV), a concept referring to the profit a miner can make through the inclusion, exclusion, or reordering of transactions within a blockchain block. Bots like “arsc” exploit this by essentially cutting in line. They strategically position a user’s transaction amidst two they control, facilitating the purchase of crypto at lower than market prices and the subsequent immediate sale at a higher rate, all within the span of a single block.

This sophisticated scheme has been traced back to a few key wallets, including one particularly large cache purportedly used for cold storage. Housing over $19 million, its assets are predominantly in Solana’s SOL and Circle’s USD Coin (USDC). Besides cold storage, there’s another hive of activity – a wallet engaging continuously in decentralized finance (DeFi) processes, shrewdly converting SOL to USDC. The ceaseless churn of these conversions is part of a grander strategy to veil the bot’s manipulations from the wary eyes of researchers and users alike.

Tracking the Trails of MEV Bots

In the dynamic panorama of digital currencies, a Solana-based bot nicknamed “arsc” has surged to infamy. It masterfully employs a “sandwich attack” to usurp around $30 million from users on the Solana network over a mere two months. By exploiting a niche known as maximal extractable value (MEV), it profits by manipulating the sequence of transactions in a blockchain block.

“arsc” intrudes into the transaction queue, sandwiching an unsuspecting user’s trade between its own. This ploy allows the bot to buy cryptocurrency cheaply and flip it immediately at a higher price in one block, making an instant profit.

Investigators have linked the scam to several wallets, with one holding a staggering $19 million – purportedly a cold storage trove, rich in Solana’s SOL and USD Coin (USDC) from Circle. Another wallet under scrutiny shows relentless DeFi activity, constantly trading SOL for USDC. This frenzy masks the bot’s activities, keeping the operation under the radar of researchers and Solana participants.

Explore more

How Does ROMULUS Scale the ClickFix Malware Threat?

The sophisticated evasion tactics used by ROMULUS operators highlight a growing trend where social engineering serves as an entry point for complex operations. This infrastructure marks a departure from traditional, static attack vectors by implementing a dynamic backend known as ClickFix. This technique capitalizes on human psychology by presenting users with realistic but entirely fraudulent browser errors or software update

OnePlus Ace 7 Series – Review

The pursuit of desktop-grade power in a pocket-sized frame has historically been thwarted by the laws of thermodynamics, yet the OnePlus Ace 7 series arrives as a defiant answer to these thermal constraints. This new lineup represents a significant advancement in the performance-oriented smartphone sector, moving beyond simple speed upgrades to address the fundamental limitations of mobile hardware. By examining

How HR Can Drive Employee Advocacy Without Mandates

Walking through the digital corridors of a major corporation often reveals a stark contrast between high-gloss marketing and the deafening silence of the people who actually perform the work. While marketing departments invest heavily in high-production social media assets, the intended recipients—the employees—rarely engage with the content. This gap between corporate output and individual sharing highlights a fundamental shift in

Cyberattacks Disrupt French Supermarket Cooling Networks

When a routine maintenance crew entered a quiet supermarket near Bordeaux, they encountered a digital phantom that was systematically turning industrial freezers into high-heat ovens by overriding every safety protocol. This alarming discovery surfaced during a standard operational check, revealing that temperature settings were not merely drifting but were being aggressively manipulated toward destructive extremes. It signaled a shift in

LiteLLM Patches Flaws Allowing Full System Takeover

Dominic Jainy has spent years at the sharp edge of technological integration, mastering the nuances of artificial intelligence, machine learning, and the decentralized potential of blockchain. As organizations in 2026 increasingly pivot toward autonomous AI ecosystems, his expertise has become a lighthouse for enterprises trying to navigate the choppy waters of rapid deployment and structural security. In this conversation, he

Fill out the form below