How Does a Solana Bot Exploit MEV for $30M Profit?

In the endlessly evolving world of cryptocurrencies, an audacious Solana-based bot known as “arsc” has swiftly advanced to notoriety. This ingenious program has leveraged a technique called “sandwich attack” to pilfer approximately $30 million from Solana users within just two months. The operation centers on a cunning exploitation of maximal extractable value (MEV), a concept referring to the profit a miner can make through the inclusion, exclusion, or reordering of transactions within a blockchain block. Bots like “arsc” exploit this by essentially cutting in line. They strategically position a user’s transaction amidst two they control, facilitating the purchase of crypto at lower than market prices and the subsequent immediate sale at a higher rate, all within the span of a single block.

This sophisticated scheme has been traced back to a few key wallets, including one particularly large cache purportedly used for cold storage. Housing over $19 million, its assets are predominantly in Solana’s SOL and Circle’s USD Coin (USDC). Besides cold storage, there’s another hive of activity – a wallet engaging continuously in decentralized finance (DeFi) processes, shrewdly converting SOL to USDC. The ceaseless churn of these conversions is part of a grander strategy to veil the bot’s manipulations from the wary eyes of researchers and users alike.

Tracking the Trails of MEV Bots

In the dynamic panorama of digital currencies, a Solana-based bot nicknamed “arsc” has surged to infamy. It masterfully employs a “sandwich attack” to usurp around $30 million from users on the Solana network over a mere two months. By exploiting a niche known as maximal extractable value (MEV), it profits by manipulating the sequence of transactions in a blockchain block.

“arsc” intrudes into the transaction queue, sandwiching an unsuspecting user’s trade between its own. This ploy allows the bot to buy cryptocurrency cheaply and flip it immediately at a higher price in one block, making an instant profit.

Investigators have linked the scam to several wallets, with one holding a staggering $19 million – purportedly a cold storage trove, rich in Solana’s SOL and USD Coin (USDC) from Circle. Another wallet under scrutiny shows relentless DeFi activity, constantly trading SOL for USDC. This frenzy masks the bot’s activities, keeping the operation under the radar of researchers and Solana participants.

Explore more

SAP Updates Cloud ERP to Advance the Autonomous Enterprise

The transition to an autonomous enterprise is an incremental achievement built upon the convergence of trusted data, specific process contexts, and established business rules. The deployment of SAP Cloud ERP Private 2025 Feature Pack Stack 02 represents a definitive pivot toward a reality where business logic and artificial intelligence operate as a unified entity. Organizations no longer view AI as

Celo Launches Marketplace for Autonomous AI Agent Commerce

By utilizing decentralized physical infrastructure networks, the platform ensures that service delivery meets the data-intensive demands of modern artificial intelligence. The digital landscape is currently witnessing a transformative shift where software is no longer just a tool but an active participant in the global economy. Celo has stepped into this breach by launching its specialized marketplace, known as “buy,” which

How Low Will Bitcoin and Ethereum Go After the Crash?

The shift in market sentiment follows a rapid descent in which Bitcoin shed fifteen hundred dollars in value within minutes of a key economic announcement. This precipitous drop has rattled the confidence of retail participants who had grown accustomed to the relatively stable upward trend characterizing the first half of the year. While the digital asset class is no stranger

Google Gemini Evolves From Chatbot to Proactive Assistant

By integrating with the broader Google software suite, Gemini can now function as a logistical coordinator that audits schedules and calculates travel times. This shift from a traditional conversational interface to an autonomous agent marks a turning point in personal computing history. No longer is the system merely waiting for a prompt; it actively monitors the digital landscape to provide

How Did a Fake Chrome App Bypass Google Play Security?

The package name com.android.chrome serves as the primary technical differentiator between the official browser and the fraudulent Hizbartech version found on the storefront. The incident involving Hizbartech has exposed a glaring vulnerability in the way mobile applications are vetted and presented to the public, especially when high-trust brands like Google Chrome are targeted. For several weeks, unsuspecting users downloaded a