MEV Bot: How Crypto Arbitrage Bots Work on Ethereum

On September 8, 2023, an Ethereum address known to traders as jaredfromsubway.eth printed a profit day that most hedge funds would envy, by sandwiching other people's Uniswap trades. That address is a MEV bot, the most notorious one on Ethereum. Every time a transaction sits in the mempool waiting to be confirmed, a swarm of MEV bots is reading it, reordering it, and pricing the right to cut in line. The money on the table is real, and the infrastructure around it is now one of the most important businesses in crypto.

This guide covers three angles in one place. First, the explainer: what a MEV bot does, what the core MEV opportunities look like, and how a modern MEV bot works from mempool scan to final block inclusion. Second, the economy: Flashbots, MEV-Boost, builders, relays, and the Solana version of the same stack. Third, the practical side: how to protect yourself when you trade on a DEX, which RPC endpoint tools actually help, and the legitimate ways to get started with MEV research. No hype. Specific numbers. Real tools.

If you have ever lost money to slippage on a large trade, a MEV crypto bot most likely had something to do with it. The first step to not losing again is learning MEV at a level that separates real profitable opportunities from the marketing pitch.

What a MEV bot is and how it scans the mempool

A MEV bot is a specialized trading bot that watches the Ethereum mempool (or any EVM-compatible blockchain's pending-transaction pool) and looks for profit opportunities created by the order of transactions. MEV stands for maximal extractable value. Older documents say "miner extractable value" because that was the original 2019 framing, but after Ethereum moved to Proof of Stake in 2022, validators took over the role and the broader term stuck.

The mempool is the public waiting room where transactions sit before a validator picks them up and packs them into the next block. MEV bots subscribe to mempool feeds over an RPC endpoint and stream pending transactions in real-time. When a large swap, a liquidation-eligible lending position, or a price gap across DEXs appears, the bot fires its own transaction, often using a smart contract, to capture the spread.

Two numbers give a sense of scale. On Ethereum alone, 2025 MEV transaction volume reached about USD 561.9 million, with sandwich attacks responsible for 51.56% of that (about USD 289.8 million), according to the ESMA TRV Risk Analysis published in July 2025. Post-Merge cumulative MEV on Ethereum is well above USD 1 billion on secondary estimates. It is a serious business, not a curiosity. ESMA itself wrote that "MEV appears to be widespread on Ethereum and growing on some other networks," which is the closest thing to a regulator waving a flag.

Key MEV opportunities: arbitrage, sandwich, liquidation

A MEV bot is only as useful as the MEV opportunities it can identify and act on. MEV strategies split into five categories that dominate the market on decentralized exchanges (dexes, in the shorthand MEV researchers use). Each targets a specific inefficiency that other traders missed.

Arbitrage. Price for the same token is briefly different across two DEXs (say ETH/USDC on Uniswap vs Sushiswap). An arbitrage bot buys low on one, sells high on the other, captures the difference in a single arbitrage transaction. EigenPhi 30-day Ethereum volumes around mid-2024 put MEV arbitrage activity near USD 5.6 billion across price differences like this. Arbitrage trading on-chain is simple, profitable, and fiercely contested.

Sandwich attacks. The bot spots a large pending trade, buys the same token right before it (frontrunning), lets the victim's trade push the price up, then sells right after (backrunning). The victim gets worse execution, the bot pockets the spread. EigenPhi tracked roughly USD 17.1 billion in sandwiched volume over a 30-day window in 2024. A single operator known as jaredfromsubway.eth has cleared more than USD 22 million in cumulative sandwich profit since March 2023 and was still responsible for roughly 70% of all Ethereum sandwich attacks in 2025, per EigenPhi data cited by Cointelegraph. Monthly sandwich extraction on Ethereum fell from close to USD 10 million in late 2024 to about USD 2.5 million by October 2025. That is still 60,000 to 90,000 attacks a month, just with thinner margins. This is the bad-reputation kind of MEV.

Liquidations. Lending protocols like Aave or Compound let liquidators close undercollateralized positions for a bonus. MEV bots race to liquidate first. Lower volume than arbitrage or sandwich trading (around USD 467 million in the same 30-day window), but bonuses are often high single-digit percentages.

JIT (just-in-time) liquidity. A bot supplies concentrated Uniswap V3 liquidity one block before a large swap, captures the fees, then withdraws one block after. Minimal capital at risk. Technically advanced.

CEX-DEX arbitrage. Prices on Binance, Coinbase, or OKX diverge from Uniswap for seconds. Market makers with good infrastructure close the gap. This strategy runs at the intersection of on-chain and off-chain and pays out consistently in volatile markets.

A single professional MEV operation often runs all five in parallel, sometimes on the same block. The table below summarizes how each strategy extracts value and who pays.

Professional MEV teams layer these trading strategies to smooth revenue across market regimes and capture advanced MEV windows most retail traders never see.

How a MEV bot works: from mempool to included block

The lifecycle of a MEV trade execution is short and brutal. Many MEV bots do all of it in under 200 milliseconds.

First, the bot connects to the blockchain through a trading platform or a self-hosted Geth, Reth, or Erigon node. Running a full Ethereum mainnet node costs roughly USD 150 per month on cloud; serious operators pair it with multiple third-party RPC services at USD 50 to USD 1,000+ per month each.

Second, the bot reads pending transactions and simulates them. Professional MEV shops use REVM (Rust Ethereum Virtual Machine) to simulate the state transition of each pending transaction in microseconds, because submitting a losing trade costs gas. Simulation is the difference between a profitable MEV bot and a slow way to burn ETH.

Third, if the simulation shows an arbitrage opportunity worth more than the expected gas cost, the bot builds its own transaction, often invoking its own smart contract. The Solidity code (or lower-level Yul for gas optimization) is kept short: a basic example of how transactions are submitted in a MEV arbitrage bundle comes from Flashbots' own simple-arbitrage repository, which fits in around 200 lines. A typical on-chain arbitrage transaction uses about 240,000 gas.

Fourth, the bot submits the transaction. On Ethereum mainnet, it sends a Flashbots bundle to a block builder through a private relay, rather than to the public mempool. This protects the bundle from being counter-front-run.

Fifth, a validator includes the bundle in a block. If it wins, the bot gets the spread and pays a tip to the builder; if it loses, it costs nothing because bundles that do not win never submit transactions on-chain (failed transactions in bundles typically do not land at all). The searcher-to-miner profit split historically settles near 5% for the searcher and 95% for the validator and builder on competitive opportunities, though exact shares vary by strategy and priority.

Flashbots, MEV-Boost and the Ethereum block-build stack

Before Flashbots, MEV was a dark-forest arms race. Bots publicly spammed high gas prices to jump ahead of each other. The spam was expensive, and failed transactions still wasted gas. Flashbots solved this in 2020 by introducing a private channel for searchers to submit bundles directly to miners, then to validators after the merge.

The modern Ethereum block-build stack has three roles.

Searchers run MEV bots. They hunt for arbitrage, liquidations, and sandwiches, and they build bundles.

Builders receive bundles from searchers and compete to assemble the most profitable block. Titan Builder, Beaver Build, Rsync, and a rotating cast of others sit at this layer.

Relays stand between builders and validators, guaranteeing that validators see the block's tip but cannot steal the bundle content. Flashbots, BloXroute, Aestus, and Agnostic are the main relays.

The mechanism that glues them together is MEV-Boost. As of 2025, roughly 90% of Ethereum blocks are built via MEV-Boost, meaning the validator outsourced block building to a specialized builder. This is a form of Proposer-Builder Separation (PBS), and it changed the economics of Ethereum validation: MEV-Boost lifts validator APY from roughly 4% to around 5.69%, a 1-2 percentage point uplift (Blocknative).

Relay market share has shifted dramatically. As of late October 2025, relayscan.io showed Ultra Sound relay handling 32.3% of MEV-Boost payloads, Titan Relay 24.75%, the two bloXroute relays a combined ~26%, and Flashbots' own relay just 3.44% of the 7-day window. A big piece of that realignment came in November 2024 when Flashbots launched BuilderNet (a decentralized block-builder running in trusted execution environments, built with Beaverbuild and Nethermind) and migrated its centralized builders onto it. The more ambitious SUAVE chain was archived in May 2025 as Flashbots pivoted to BuilderNet and Flashnet infrastructure. Solo stakers still propose, but the next block they propose is almost always assembled by a builder shop with a serious infrastructure budget.

Solana MEV: Jito tips and the inclusion market

Solana has no mempool in the Ethereum sense. Transactions go directly to validators via a gossip network. That changes how MEV works but does not eliminate it.

Jito Labs built the main MEV infrastructure on Solana. The Jito-Solana client, a modified validator binary, lets MEV searchers submit bundles with tips that validators capture. Jito adoption jumped from 48% of Solana stake in January 2024 to about 92-93% one year later, which makes it effectively universal among professional validators. Jito tips to validators and stakers totalled roughly USD 674 million cumulatively heading into 2025, peaked at USD 210 million in a single month (November 2024), and hit an all-time high of USD 14.7 million in a single day on November 17, 2024. TipRouter distributes 97% of those tips to validators and stakers pro-rata; MEV rewards averaged 11.79% of weekly JitoSOL staking rewards in 2024, peaking at 43% in the week of November 18-25, 2024.

Solana's MEV economy is not just big. For a moment, it was bigger than Ethereum's. Q4 2024 Solana REV (fees plus tips) reached USD 1.4 billion, largely driven by Jito MEV tips. Nobody saw that coming five years ago.

High-profile sandwich operators on Solana have left bruises. Sandwiched.me analyzed 8.5 billion trades and roughly USD 1 trillion of Solana DEX volume between January 2024 and May 2025 and flagged USD 370-500 million in extracted value. The wallet cluster "arsc" accumulated about USD 30 million in just two months in 2024 according to MRGN Research. A single operator labelled Vpe (DeezNode) pulled USD 13.4 million across 1.55 million sandwich transactions in a 30-day window between December 7, 2024 and January 5, 2025 (Helius). One January 2024 incident saw a bot pull about USD 1.9 million from a single Solana transaction. Marinade Finance responded by blacklisting 50+ validators from its Stake Auction Marketplace, Jito blacklisted offending operators at epoch 789, and researchers estimate coordinated 2025 moves cut Solana sandwich profitability by 60-70%.

How much money do MEV bots actually make?

Two numbers frame the answer. First, MEV is a winner-take-most market. Industry research from 2024-2025 estimated cumulative MEV profits across all blockchains passed USD 1 billion; a much-cited earlier figure put Ethereum-only MEV profits at USD 675 million between 2019 and early 2022. Second, that profit is highly concentrated in a dozen or fewer searcher teams running at near-hardware speed.

Retail is mostly on the wrong side of these trades. Losses to sandwich attacks and LVR (loss-versus-rebalancing) against arbitrageurs amount to hundreds of millions of dollars per year for liquidity providers alone. CoW Protocol's team estimates LVR costs liquidity pool providers roughly 5-7% of their liquidity over time. That is not a rounding error.

The other cost line nobody talks about: gas fees. A Rust-based MEV operator described burning 80-90% of gross profit in priority gas auctions (PGAs) against other bots. EigenPhi data cited by ESMA shows 90%+ of searcher revenue on Ethereum is paid onward to builders and validators as bribes. Net margins in the single digits are common, and one well-known source of that profit flow is Banana Gun, the Telegram sniper bot that has processed roughly USD 16 billion in cumulative trading volume, paid out an estimated USD 50 million in builder priority fees and bribes in 2024, and is involved in about 40% of MEV-Boost auctions (Theia Research).

How to protect yourself from a MEV bot

Most retail users do not run a MEV bot. They lose to one. The good news is that defensive tools in 2025-2026 are finally good enough that an average DeFi trader can avoid the worst of it.

Start with the settings you control. Setting a low slippage tolerance on every swap is the single cheapest defense. Two percent is generous; 0.5% is better on liquid pairs. A tighter tolerance caps how much a sandwich can steal from you before the trade reverts. Failed transactions still cost gas, but they are cheaper than being drained.

Avoid trading through interfaces that leak your transaction to the public mempool without protection. Most Uniswap web frontends now support optional private RPCs. Enable one.

For larger trades, route through DEXs that price execution at the batch level instead of the transaction level. More on that in the next section.

Finally, never install a "MEV bot" someone messaged you about on Telegram or YouTube. Just delete the DM. The AI-powered "MEV bot" scam category was documented in 2024 with a single scammer's wallet holding roughly 156 ETH (about USD 411,000) siphoned from retail victims. Real MEV infrastructure is boring and open-source; scams are flashy, private, and confident.

RPC endpoints and private mempools in practice

A private RPC endpoint is an off-ramp around the public mempool. You send your transaction to a private relay, which forwards it to a builder. Searchers cannot see the transaction in flight, so they cannot sandwich it.

Flashbots Protect. Free public RPC. Drops your transaction into the Flashbots builder lane. Simple and widely used. Works in MetaMask with a one-click network add. As of October 2024, Flashbots Protect had served 2.1 million unique Ethereum accounts, shielded USD 43 billion of DEX volume, paid out 313 ETH in MEV refunds, and handled more than 30 million daily requests.

MEV Blocker. Built by the CoW DAO and Agnostic Relay, acquired by the Consensys Special Mechanisms Group in January 2026. Routes transactions through a searcher auction that pays up to 90% of captured back-run value back to the user. MEV Blocker has served over 4.5 million unique wallets, paid 6,177 ETH in cumulative rebates (4,079 ETH in 2024 alone), and protected USD 60 billion+ of DEX volume as of May 2025. Recovered value is meaningful for larger swaps.

BloXroute BDN. Lower-latency RPC popular with professional searchers, but useful to ordinary traders who want a separate relay option.

MEV-Share. A programmable MEV relay from Flashbots that lets users opt into selective transaction disclosure and capture a share of the MEV their trade creates. More advanced, but the most interesting direction for the space.

Private RPCs do not eliminate all risk. If the builder is compromised or colludes with a searcher, protection weakens. Diversify: rotate between Flashbots Protect and MEV Blocker for large trades, keep a backup public RPC for emergencies.

None of these protection tools require you to run a MEV bot yourself. They simply hide your transaction from the public mempool data and shift execution into adversarial-resistant formats.

DEX-level MEV protection: CoW, UniswapX, 1inch

Some DEXs redesigned execution to make sandwiches impossible or economically pointless.

CoW Swap (CoW Protocol). Trades settle in batch auctions every few seconds. Every trade in a batch clears at the same uniform price, so there is no intra-batch reordering to exploit. Coincidence of Wants matching means many trades never touch an AMM at all. MEV protection is the default, not an option. CoW Swap hit an all-time-high USD 9 billion in monthly volume in July 2025 and 34.3% of DEX aggregator market share that month — a strong sign that intent-based execution is not a niche anymore.

UniswapX. Uses a Dutch-auction mechanism where fillers compete off-chain to execute your order at the best price. The winning filler submits on-chain. Users get best-price execution, and sandwichers have no pending transaction to attack.

1inch Fusion. Similar gasless, Dutch-auction design. Resolvers (professional searchers) compete to execute at limit prices you set.

Hashflow. Request-for-quote DEX where professional market makers commit to a price before execution. No slippage, no sandwich vector. Cumulative RFQ volume since 2021 is in the USD 18-20 billion range, and Hashflow expanded to Solana via Jupiter and Kamino in 2025.

These architectures effectively shift the MEV problem from the user to the searcher network. The searchers still compete on price, but the user gets most of the value because the execution mechanism is adversarial to sandwich attacks by design.

How to get started with MEV research and tooling

If you want to understand MEV deeply rather than just trade around it, the learning curve is steep but the tools are public.

Start on the data side. EigenPhi, MEVWatch, and Flashbots' mev-inspect tool let you browse every MEV transaction on Ethereum and decompose it by strategy. Dune Analytics hosts dozens of community-built MEV dashboards for free. Ethstakers' Rated Network dashboard shows relay and builder market share in near-real-time.

On the engineering side, the best way to get started is to read simple-arbitrage from Flashbots (the canonical 200-line example of Solidity code plus JavaScript driver), Subway (a well-documented sandwich bot), and Rusty-sando for the Rust implementation. Paul Razvan's and Pawel Urbanek's write-ups on building unprofitable MEV bots in Rust are the most honest existing guides. They talk about MEV the way practitioners talk about it to each other: lots of internal transactions to trace, a painful amount of sophisticated MEV infrastructure to maintain, and a real risk of loss if you push live without tests.

The cost of serious MEV research is not zero. A Rust-based bot project often runs past 10,000 lines of client code and requires a mainnet node plus several third-party RPCs. Serious MEV searcher operations also rent low-latency VPS boxes in the same data centers as builders; network congestion and latency can decide whether a bundle lands or gets counter-bid. Budget USD 500 to USD 2,000 per month in infrastructure before you write a single line of arbitrage logic for your digital assets.

What almost every professional MEV practitioner says out loud: do not expect to out-compete established bots on vanilla arbitrage trading. Look at long-tail market opportunities. Tokens with custom transfer mechanics, brand-new DEX forks, small liquidity pools, triangular paths with unpopular pairs. That is where the last real edge lives in 2026.

Layer-2 MEV is also worth watching if you want to extract value where the competition is thinner. In Q1 2025, cyclic-arbitrage probes accounted for more than 50% of on-chain gas on Base and Optimism, compared with just 7% on Arbitrum (Extropy analysis). Arbitrum launched TimeBoost sequencing in April 2025, Base introduced Flashblocks in July 2025, and Unichain followed with its own sequencer changes in August 2025. Each of these reshapes MEV economics on the rollup and creates new windows for searchers who move fast.

Marco Lucchetti

Marco Lucchetti is a senior content strategist and blockchain analyst at Plisio. With over 7 years of experience in cryptocurrency research, DeFi protocols, and payment technologies, Marco specializes in creating clear, data-driven content for a global crypto audience. His work focuses on transaction tracing, crypto compliance, and the future of blockchain infrastructure.