MEV bot loses $180K in ETH from access control exploit

A maximal extractable value (MEV) bot encountered a significant loss of approximately $180,000 in Ether after an attacker took advantage of a vulnerability in its access control mechanisms.

On April 8, a blockchain security firm reported that the MEV bot lost 116.7 Ether (ETH) due to insufficient access controls. A threat researcher, known as Officer’s Notes on social media, indicated that the attacker exploited a weakness in the bot, which allowed it to swap its ETH for a fraudulent token.

The researcher explained that the exploit occurred through a malicious pool the attacker created within the same transaction. He emphasized that stronger access controls could have averted this situation for the MEV owner.

Shortly after the incident, only 25 minutes into the exploit, the MEV owner offered a bounty to the attacker and subsequently launched a new bot featuring enhanced access control validations.

The researcher drew parallels to another incident in 2023, during which MEV bots faced losses totaling $25 million due to a similar exploit. On April 23, 2023, bots participating in sandwich trades lost their assets to a rogue validator.