July 26, 2025 — As DeFi continues its evolution, a stealthy menace looms over traders: MEV bots executing sandwich attacks. These automated agents relentlessly prey on public transaction pools, undermining swaps, driving up fees, and often lining their own pockets at the expense of users. Understanding how they function and how to defend against them is now essential for serious participants in crypto markets.
How Sandwich Attacks Work on DeFi
MEV bots monitor pending transactions in public mempools—where trades sit before confirmation. When a bot spots a large DEX swap, it typically executes a sandwich attack: buying ahead of the victim to raise the price, then selling immediately after to capitalize on the shift. This three-step manoeuvre extracts value while leaving the trader slippage-heavy and undercut. Sandwich attacks are currently among the most common forms of MEV abuse.
On Ethereum and Solana alike, these bots execute thousands of attacks daily. One case study found a single bot extracting over 6,900 SOL profit in 30 days while victimising nearly 79,000 users—a stark reminder of how pervasive and damaging these strategies can be.
Why Traders Are Vulnerable
Transparency in DeFi is both a strength and a weakness. Public mempools expose user trades before finalisation, creating opportunities for bots to exploit visible orders. Poor slippage settings further increase risk: high tolerances allow bots to manipulate price movement more aggressively. AMM-based swaps are prime targets due to how constant product formulas react to large trades.
Even routine trades become exploitable—bots simulate transactions, compute optimal gas fees or tips, and execute front- and back-run orders in milliseconds via private relays like Flashbots to stay undetected.
Tools That Help Protect Traders
Several tools and protocols have emerged to mitigate sandwich and other MEV tactics:
- Flashbots Protect and MEV Blocker: These private RPC endpoints shield user transactions by submitting them directly to block builders, bypassing public mempools entirely. They support MetaMask, Rabby, and similar wallets.
- Protected swaps via CoW Swap and 1inch: These platforms execute trades via sealed batch auctions or protected routing—neutralising classic sandwich strategy by batching orders or hiding intent.
- Slippage control and strategic timing: Traders should set slippage to 0.1–0.5% where possible, avoid volatile tokens, and steer clear of periods of high gas fees. Trading during lower congestion windows (often early UTC) reduces sandwich risk.
How MEV Bots Impact Markets
Major incidents reveal the scale: between 2023 and mid-2025, sandwich attacks and arbitration bots collectively caused a financial drain for thousands of retail traders, costing users millions. One exploit netted nearly $25 million; others generated steady returns at the cost of regular users’ liquidity.
MEV’s ripple effects also escalate network costs. During high-impact events, bots launch bidding wars for block inclusion, inflating gas fees and creating consensus instability. During intense flash-loan cycles or token launches, fees spiked by multiples of 10–20x, driven largely by searcher competition.
What Traders Should Do Now
Here’s how savvy traders can stay safe:
- Use private relays like Flashbots Protect to avoid exposing transactions publicly.
- Set strict slippage tolerance limits, ideally under 0.5%, tailored to trade size and pool depth.
- Opt for MEV-aware DEXs such as CoW Swap or protected routes on leading aggregators.
- Avoid trading during gas storms, which attract searcher competition and worsen execution costs.
- Monitor flashbots and mempool dynamics using tools to recognize potential extraction zones in real time.
Final Thoughts
MEV bots and sandwich attacks have transitioned from fringe nuisances to structural threats in DeFi. But the battlefield is levelling—thanks to innovations in private transaction relays, fair sequencing, and batch-execution models.
Traders no longer need to accept extractive slippage as inevitable. By adopting mitigation tools, managing slippage, and staying informed, they can safeguard their capital and restore fairness to decentralized trading. In 2025, knowledge isn’t just power—it’s protection.