Your DeFi Trade Can Get Sandwiched Between Two Other Trades Before It Even Confirms. This Is Called MEV
5 min read
Loading...
5 min read
You swap on a decentralized exchange. The screen shows one price. The trade fills at a worse one. Nobody hacked your wallet, and nothing was stolen in the usual sense. A bot simply saw your trade coming and traded around it. This is MEV, short for Maximal Extractable Value, and the most common way it shows up for an ordinary trader is a sandwich attack.
Sandwich attacks alone drained close to $40 million from Ethereum users in 2025, according to data the analytics platform EigenPhi gave to Cointelegraph in December 2025, even as the total dollar value traded on decentralized exchanges kept climbing. Understanding how this works is the only way to stop paying it.
Every trade you send to a blockchain does not settle instantly. It first sits in a public waiting room called the mempool, visible to anyone watching, before whoever builds the next block decides which pending trades go in and in what order. MEV is the extra profit that can be extracted by choosing that order, or by inserting new trades around yours, before your trade is confirmed.
The idea isn't new. On a stock exchange, order flow is private and heavily regulated specifically to prevent this. On most blockchains, the waiting room is public by design, so anyone running the right software can watch it and act on what they see.
A sandwich attack takes its name from the shape of it: your trade sits in the middle, with two of the attacker's own trades wrapped around it.
Here's an illustrative example, not a real trade. Say you want to swap 50,000 USDC for ETH on a decentralized exchange, and the pool's price would normally give you about 20 ETH.
You didn't lose your funds to a hack. You lost the gap between the price you were quoted and the price you actually got, and that gap is exactly what the bot made.
Running a sandwich bot takes real infrastructure: software watching the mempool around the clock, and enough capital to front-run trades at scale. In practice, a small number of operators account for most of it. EigenPhi's own research has repeatedly identified a single bot known publicly as jaredfromsubway.eth as one of the most prolific sandwich operators on Ethereum since 2023.
The EigenPhi data cited by Cointelegraph, covering roughly 95,000 sandwich attacks between November 2024 and October 2025, shows two things moving in opposite directions. Monthly extraction from sandwich attacks fell from close to $10 million in late 2024 to about $2.5 million by October 2025, even while monthly trading volume on decentralized exchanges rose from around $65 billion to over $100 billion over the same stretch. Sandwich attacks are shrinking as a share of activity, not because trading slowed down, but because more traders are using tools that route around the public mempool entirely.
None of this requires you to stop using decentralized exchanges. It requires knowing what actually causes it.
MEV is a structural feature of how public blockchains order transactions, not a bug in any one exchange. It won't disappear, but a trader who understands it loses far less to it than one who doesn't.
If you hold ETH or other assets that trade heavily on decentralized exchanges, NetWort's Explore screener lets you check an asset's actual price and volatility history before you size a trade, which matters more than usual for a pair or a pool where a large swap can move the price on its own. You can also look up ETH's own price history directly before deciding how large a swap actually makes sense.