Notorious sandwich-attack bot 'jaredfromsubway' was drained after an attacker spun up 66 fake wrapper tokens and pools mimicking WETH, USDC and USDT to lure it in.

No code was hacked: lured by fake 'arbitrage', the bot kept approving attacker contracts, which then swept ~1,475 WETH plus ~$4.9M in USDC/USDT in one tx.

Blockaid pegs the loss near $7.5M; Jared himself claims $15M. About 1,000 ETH was then routed through Tornado Cash.