How Does a Solana Bot Exploit MEV for $30M Profit?

June 17, 2024

Image Credit: Unsplash

How Does a Solana Bot Exploit MEV for $30M Profit?

In the endlessly evolving world of cryptocurrencies, an audacious Solana-based bot known as “arsc” has swiftly advanced to notoriety. This ingenious program has leveraged a technique called “sandwich attack” to pilfer approximately $30 million from Solana users within just two months. The operation centers on a cunning exploitation of maximal extractable value (MEV), a concept referring to the profit a miner can make through the inclusion, exclusion, or reordering of transactions within a blockchain block. Bots like “arsc” exploit this by essentially cutting in line. They strategically position a user’s transaction amidst two they control, facilitating the purchase of crypto at lower than market prices and the subsequent immediate sale at a higher rate, all within the span of a single block.

This sophisticated scheme has been traced back to a few key wallets, including one particularly large cache purportedly used for cold storage. Housing over $19 million, its assets are predominantly in Solana’s SOL and Circle’s USD Coin (USDC). Besides cold storage, there’s another hive of activity – a wallet engaging continuously in decentralized finance (DeFi) processes, shrewdly converting SOL to USDC. The ceaseless churn of these conversions is part of a grander strategy to veil the bot’s manipulations from the wary eyes of researchers and users alike.

Tracking the Trails of MEV Bots

In the dynamic panorama of digital currencies, a Solana-based bot nicknamed “arsc” has surged to infamy. It masterfully employs a “sandwich attack” to usurp around $30 million from users on the Solana network over a mere two months. By exploiting a niche known as maximal extractable value (MEV), it profits by manipulating the sequence of transactions in a blockchain block.

“arsc” intrudes into the transaction queue, sandwiching an unsuspecting user’s trade between its own. This ploy allows the bot to buy cryptocurrency cheaply and flip it immediately at a higher price in one block, making an instant profit.

Investigators have linked the scam to several wallets, with one holding a staggering $19 million – purportedly a cold storage trove, rich in Solana’s SOL and USD Coin (USDC) from Circle. Another wallet under scrutiny shows relentless DeFi activity, constantly trading SOL for USDC. This frenzy masks the bot’s activities, keeping the operation under the radar of researchers and Solana participants.

Explore more

AI-Powered Trading Tools – Review

January 5, 2026

The unrelenting deluge of real-time financial data has fundamentally transformed the landscape of trading, rendering purely manual analysis a relic of a bygone era for those seeking a competitive edge. AI-Powered Trading Tools represent the next significant advancement in financial technology, leveraging machine learning and advanced algorithms to sift through market complexity. This review explores the evolution of this technology,

Trend Analysis: Modern Threat Intelligence

January 5, 2026

The relentless drumbeat of automated attacks has pushed the traditional, human-powered security operations model to its absolute limit, creating an unsustainable cycle of reaction and burnout. As cyber-attacks grow faster and more sophisticated, the Security Operations Center (SOC) is at a breaking point. Constantly reacting to an endless flood of alerts, many teams are losing the battle against advanced adversaries.

CISA Warns of Actively Exploited Apple WebKit Flaw

January 5, 2026

The seamless web browsing experience enjoyed by millions of Apple users unknowingly concealed a critical zero-day vulnerability that attackers were actively using to compromise devices across the globe. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) brought this hidden danger into the light with a stark warning, adding the flaw to its catalog of known exploited vulnerabilities and signaling a

Critical FortiWeb Flaw Actively Exploited for Admin Takeover

January 5, 2026

Introduction The very security appliance designed to stand as a digital sentinel at the edge of a network can tragically become an unlocked gateway for intruders when a critical flaw emerges from the shadows. A recently discovered vulnerability in Fortinet’s FortiWeb products underscores this reality, as threat actors have been actively exploiting it to achieve complete administrative control over affected

Trend Analysis: Defense Supply Chain Security

January 5, 2026

The digital backbone of national defense is only as strong as its most vulnerable supplier, a stark reality that has triggered a fundamental shift in how governments approach cybersecurity. In an interconnected world where a single breach can cascade through an entire network, the protection of sensitive government information depends on a fortified and verifiable supply chain. This analysis examines