MEV Strategies in 2026: The Bots That Reorder Your Trades
Maximal extractable value quietly taxes nearly every on-chain trade. Here is how MEV strategies work, who profits, and how Ethereum's 2026 roadmap plans to tame the auction.
In April 2023, two brothers pulled roughly $25 million out of Ethereum in about twelve seconds. They cracked no cryptography and stole no private keys. Instead they exploited the plumbing that decides which transactions enter a block and in what order, the same plumbing that a small, sophisticated industry of bots mines for profit on every single block. That industry has a name most retail traders never see on their screens: maximal extractable value, or MEV.
MEV is the hidden layer of the on-chain economy. It explains why a swap sometimes fills at a worse price than the interface promised, why lending liquidations clear in one atomic transaction, and why Ethereum validators earn more than the base issuance schedule alone would pay them. This guide maps the strategies searchers use to capture MEV, the supply chain that routes it from your wallet to the block, the defenses that blunt the predatory forms, and the protocol upgrades arriving through 2026 that aim to bring the whole auction on-chain.
What MEV Actually Is
The Ethereum Foundation’s developer documentation defines MEV as “the maximum value that can be extracted from block production in excess of the standard block reward and gas fees by including, excluding, and changing the order of transactions in a block” (ethereum.org). In plainer terms, whoever assembles a block holds a brief monopoly over ordering, and that monopoly is worth money.
A quick example makes it concrete. Say you place a $50,000 swap on a decentralized exchange and set a 2% slippage tolerance. A searcher watching the mempool can buy the same token just ahead of you, let your order push the price up toward that 2% ceiling, then sell into your trade and pocket much of the difference. Nothing was hacked and no rule of the protocol was broken; the searcher simply paid for the right to sit in front of you in the block. Multiply that by thousands of trades a day and you have an industry.
The concept was named in 2019 by a landmark academic paper, Flash Boys 2.0, written by Philip Daian and seven co-authors. The paper coined the term miner extractable value and warned that the fees bots pay to win favorable ordering pose “concrete, measurable, consensus-layer security risks” (arXiv). After Ethereum switched to proof of stake in 2022, miners became validators and the M was quietly redefined from miner to maximal, but the mechanic is unchanged.
A year after that paper, researchers Dan Robinson and Georgios Konstantopoulos gave the problem its most memorable image, describing the public mempool as a ‘dark forest’ where any profitable transaction you broadcast can be spotted and devoured by predatory bots before it confirms (Paradigm). That framing still captures the lived experience of trading on-chain without protection.
Crucially, MEV is not a synonym for theft. It sits on a spectrum. At one end, arbitrage keeps token prices consistent across venues and quietly benefits the market. At the other, sandwich attacks skim value directly from ordinary traders. Between them sit liquidations, just-in-time liquidity, and a long tail of niche plays. Understanding the difference is the whole point of studying MEV strategies rather than lumping them into one scary acronym.
The MEV Supply Chain: From Your Click to the Block
Modern MEV does not flow through a single actor. Since Ethereum’s move to proof of stake, extraction runs along a specialized supply chain, and knowing the roles is the key to understanding both the strategies and the defenses against them.
| Role | What it does | Why it matters |
|---|---|---|
| User / trader | Signs and broadcasts a transaction | Creates the raw order flow MEV feeds on |
| Wallet / RPC | Sends the transaction to the public mempool or a private endpoint | Decides whether searchers can see you |
| Searcher | Scans state and pending transactions, builds profitable bundles | The strategist that finds the MEV |
| Builder | Orders bundles and transactions into a full block | Concentrates power; a few builders dominate |
| Relay | Passes blocks from builder to validator, withholding contents | A trusted middleman and single point of failure |
| Validator | Selects the most profitable block and proposes it | Earns the MEV premium on top of issuance |
Most of this machinery is glued together by MEV-Boost, open-source software from the research group Flashbots that lets validators outsource block construction to a competitive market of builders (Flashbots). The overwhelming majority of Ethereum validators run it, because the builder market consistently pays more than a validator could earn assembling blocks alone. That premium is one reason anyone weighing whether to run their own node should factor MEV into the math, a point we cover in our guide to solo staking after Fusaka.
The timing is what makes the system work. When a validator is due to propose, competing builders submit sealed bids to relays for the right to have their block chosen, each bid reflecting the total value, MEV included, that the block captures. The validator signs the most valuable header without seeing its contents, and only then does the relay reveal the full block. That blind commitment is meant to stop a validator from stealing a builder’s work, and it is precisely the step the Peraire-Bueno brothers later learned to break.
The supply chain also concentrates power in worrying ways. A handful of builders assemble most Ethereum blocks, and relays sit as trusted intermediaries between them and validators. That concentration became a live censorship debate after 2022, when some relays began filtering transactions tied to sanctioned addresses, prompting Ethereum researchers to prioritize censorship resistance in the protocol’s roadmap (Vitalik Buterin). Hold that thought; it is the reason the endgame described later in this guide matters so much.
A Field Guide to the Core Strategies
Before examining each play in detail, it helps to see them side by side. The table below sorts the main MEV strategies by how they work, who profits, and who ultimately pays. Atomic means the trade either fully succeeds or reverts in one transaction, which makes it effectively risk-free for the searcher.
| Strategy | How it works | Who profits | Who pays | Atomic? |
|---|---|---|---|---|
| DEX arbitrage | Buys low on one pool, sells high on another in one transaction | Searcher, and the market | Nobody directly; corrects mispricing | Yes |
| CEX-DEX arbitrage | Trades a price gap between a centralized exchange and a pool | Professional firms | Nobody directly | No |
| Liquidation | Repays unhealthy debt, seizes collateral at a bonus | Searcher | The liquidated borrower | Yes |
| Sandwich | Front-runs and back-runs a victim swap | Searcher | The retail trader, as slippage | Yes |
| JIT liquidity | Adds and removes concentrated liquidity around a big swap | Searcher | Passive liquidity providers | Yes |
| Backrun | Places a transaction right after yours to capture arbitrage | Searcher, shared via auctions | Nobody directly | Yes |
| Time-bandit / reorg | Rewrites recent blocks to steal past MEV | Validator | Chain security itself | No |
Arbitrage: Keeping Prices Honest
Arbitrage is the oldest and least controversial MEV strategy. When the same asset trades at different prices on two venues, a searcher buys low and sells high in the same block, pocketing the spread. On-chain, this most often means DEX-to-DEX arbitrage: if the ETH/USDC price on one automated market maker drifts from another, a bot rebalances both pools in a single atomic transaction. Because the trade reverts if it is not profitable, the searcher takes almost no price risk. Our explainer on AMM design covers why these pools drift in the first place.
The larger and harder category is CEX-DEX arbitrage, where a firm exploits price gaps between a centralized exchange such as Coinbase and an on-chain pool. This form is not atomic; the searcher fills one leg off-chain and one on-chain, carrying real inventory risk in between, and winning it is a latency and capital game dominated by professional trading firms. Either way, arbitrage is the benign backbone of MEV. It aligns prices, tightens spreads, and rewards whoever restores the market fastest. Most analysts put arbitrage and liquidations together as the majority of extracted value, which is why researchers who study MEV rarely argue for abolishing it outright.
Liquidations: The Race to Repay Bad Debt
Lending protocols such as Aave, Compound, and Sky (formerly MakerDAO) require borrowers to stay overcollateralized. When a position’s health factor falls below its threshold, usually because collateral drops or debt grows, anyone can repay part of the loan and seize the borrower’s collateral at a discount known as the liquidation bonus. Searchers compete to be first, because the bonus is pure profit if you win and nothing if you lose.
This strategy is socially useful: liquidations keep lending markets solvent and protect depositors from bad debt, and during sharp market drops they clear risk that would otherwise cascade. But the competition is fierce. When a large position becomes liquidatable, bots flood the network with near-identical transactions, bidding up gas to win the ordering. That congestion is a textbook example of the priority gas auctions the Flash Boys 2.0 authors flagged, where the value of ordering leaks out as fees paid to the block producer rather than to the person who first spotted the opportunity. Private order flow has since moved much of this competition off the public mempool, but the underlying race remains.
Sandwich Attacks: The Tax on Retail
If arbitrage is the friendly face of MEV, sandwich attacks are the predatory one. The mechanic is simple. A bot spots your pending swap in the public mempool, buys the same token just ahead of you and pushes the price up, lets your trade execute at the inflated price, then sells immediately after for a profit. You are the filling in the sandwich, and the cost shows up as slippage. The wider your slippage tolerance, the more a sandwicher can safely steal.
The scale is measurable. Data from the analytics platform EigenPhi, reported by Cointelegraph Research, covered more than 95,000 sandwich attacks on Ethereum between November 2024 and October 2025 (Cointelegraph Research). Monthly extraction from sandwiches fell from nearly $10 million in late 2024 to roughly $2.5 million by October 2025, even as decentralized exchange volume rose. Traders still lost around $60 million over the year, spread across a relentless 60,000 to 90,000 attacks per month.
The economics are lopsided in surprising ways. The average sandwich netted just over $3, and only six attackers cleared more than $10,000 in total profit across the whole period. One address, jaredfromsubway.eth, accounted for roughly 70% of all sandwich attacks, and about 38% of attacks targeted low-volatility pools of stablecoins, wrapped tokens, and liquid staking assets, where predictable prices make the math easy. The steady decline in sandwich profits is not an accident; it tracks the rise of the protected order flow tools covered later in this guide.
JIT Liquidity, Backrunning, and NFT MEV
The long tail of MEV is where the strategies get creative. Just-in-time (JIT) liquidity is a concentrated-liquidity trick: seeing a large swap about to hit a Uniswap v3 pool, a searcher adds a tight band of liquidity in the same block to capture most of the trading fee, then removes it immediately after. The passive liquidity providers who were supposed to earn that fee get crowded out, which is why JIT sits in an ethical gray zone even though it can tighten the price the trader receives.
Backrunning is the gentler cousin of the sandwich: instead of front-running you, a bot places its transaction directly after yours to capture the arbitrage your trade creates, without moving your price. This is the basis of order flow auctions such as MEV-Share, which let users sell the right to backrun their transactions and receive a rebate, turning a leak into a partial refund. NFT MEV rounds out the tail, with bots front-running mints or sniping mispriced listings the instant they appear, a reminder that anywhere ordering matters, MEV follows.
Cross-Domain and Reorg MEV: When Ordering Threatens Consensus
The most systemically dangerous strategies are the ones that reach beyond a single block. Cross-domain MEV spans multiple chains or rollups; a searcher coordinates trades across Ethereum and its layer 2s, or across two different rollups, to capture a price gap that no single domain can see on its own. As liquidity fragments across dozens of chains, this category keeps growing, and it is far harder to police than a neat atomic bundle on one chain.
More alarming is time-bandit MEV, where a validator is tempted to rewrite recent history. If the MEV sitting in an already-confirmed block is large enough, a rational block producer might try to reorganize the chain to grab it rather than build honestly on top. This is exactly the consensus instability the Flash Boys 2.0 paper warned about: when the reward for reordering the past exceeds the reward for extending the chain, the security assumptions of the blockchain itself come under pressure. It is the reason serious researchers treat MEV as a protocol-design problem, not merely a trading nuisance.
The $25 Million Heist That Put MEV on Trial
All of this stopped being abstract in April 2023, when Anton and James Peraire-Bueno, two MIT-educated brothers, turned the MEV supply chain against itself. According to Cointelegraph’s reconstruction of the indictment, they set up their own Ethereum validators, sent a handful of bait transactions to map how sandwich bots behaved, then published eight lure transactions that three searcher bots rushed to sandwich (Cointelegraph).
The trick was in the relay. When one of their validators was in line to propose the block, the brothers exploited the way a MEV-Boost relay released the block’s full contents in exchange for a signature, sending a false one to obtain the searchers’ bundles early. They then published a reordered block that reversed the bots’ intended trades, leaving the searchers with losses and the brothers with roughly $25 million, all in about twelve seconds. The US Department of Justice charged them in May 2024 with conspiracy to commit wire fraud, wire fraud, and conspiracy to commit money laundering (Department of Justice).
Then US Attorney for the Southern District of New York Damian Williams called it a first-of-its-kind scheme, saying “the defendants’ scheme calls the very integrity of the blockchain into question” (CoinDesk). The case is far from settled. In November 2025, after a jury deadlocked over whether the brothers acted with criminal intent, the judge declared a mistrial, and prosecutors have not said whether they will retry it (DL News). The episode is a reminder that a relay is a trusted third party running unaudited code, exactly the kind of component that formal verification is meant to harden. Whatever the eventual verdict, the trial forced a courtroom to weigh whether reordering blocks for profit is clever trading or wire fraud.
Fighting Back: How Users and DEXs Defend
Users are not defenseless. The single most effective move is to keep transactions out of the public mempool, where searchers hunt. Private RPC endpoints such as Flashbots Protect and MEV Blocker route your transaction straight to builders, hiding it from front-runners and, in MEV Blocker’s case, returning a share of any backrun profit as a rebate (CoW DAO). Flashbots itself frames its mission as an effort to “mitigate the negative externalities and existential risks posed by” MEV (Flashbots).
Decentralized exchanges are redesigning the trade itself. CoW Swap collects orders over a short window, then auctions the right to settle them to competing solvers who must return the best possible price; because everyone in a batch clears at a single uniform price, there is no gap for a sandwich to slip into. The model is spreading. In 2026, Aave integrated CoW’s infrastructure to offer MEV-protected swaps and intent-based flash loans (The Block).
The broader shift is toward intents, where you specify the outcome you want and let a solver compete to deliver it, rather than signing a specific path an attacker can read in advance. That design pairs naturally with smart wallets, as we explore in our look at native account abstraction. For a trader, the defensive playbook comes down to a few habits:
- Route swaps through a private RPC such as Flashbots Protect or MEV Blocker.
- Prefer batch-auction venues like CoW Swap for spot trades.
- Keep slippage tolerance as tight as the trade allows.
- Use aggregators or request-for-quote desks for large orders.
The table below maps these defenses to the layer of the stack where they operate.
| Approach | Mechanism | Layer | Example |
|---|---|---|---|
| Private RPC | Hides transactions from the public mempool | Wallet / routing | Flashbots Protect, MEV Blocker |
| Batch auction | Clears many orders at one uniform price | Application / DEX | CoW Swap |
| Intents and solvers | You state the outcome; solvers compete to fill it | Application | CoW Swap, UniswapX-style flows |
| Order flow auction | Sells backrun rights and rebates the user | Routing | MEV-Share, MEV Blocker |
| Enshrined PBS | Moves the block auction into the protocol | Protocol (L1) | ePBS (EIP-7732) |
| Inclusion lists | Forces builders to include censored transactions | Protocol (L1) | FOCIL (EIP-7805) |
| Sequencer auction | Auctions priority and delays others | Rollup (L2) | Arbitrum Timeboost |
MEV Beyond Ethereum: Solana and the L2s
MEV is not an Ethereum-only phenomenon; every chain that orders transactions has it, but the shape differs. Solana has no public mempool, so there is nothing to watch and front-run in the Ethereum sense. Instead the contest is a microsecond race to reach the current slot leader, and most of it flows through Jito, whose Block Engine runs an off-chain auction where searchers submit atomic bundles with explicit SOL tips attached to win placement (Jito). The majority of Solana’s staked validators run the Jito-Solana client, which makes that auction the de facto market for ordering on the network.
Layer 2s face their own version of the problem. Because most rollups still run a single sequencer, that operator holds the ordering monopoly outright. Arbitrum’s answer, Timeboost, launched in April 2025 and auctions a short-lived express lane using a sealed-bid, second-price format; the winner gets priority while everyone else takes a 200-millisecond delay, letting the chain capture MEV for itself rather than leak it to a latency race (The Defiant). The design is not without critics, with researchers arguing that time-based express lanes can concentrate advantage among a few well-capitalized bidders and encourage spam (arXiv).
The Endgame: ePBS, FOCIL, and Enshrining the Auction
The Peraire-Bueno case exposed the deepest structural problem in today’s design: the relays that make MEV-Boost work are trusted intermediaries, and trust is a vulnerability. Ethereum’s roadmap answer is to move the whole auction into the protocol. Enshrined proposer-builder separation (ePBS, specified in EIP-7732) is a headline feature of the Glamsterdam upgrade expected in 2026, and it replaces off-chain relays with in-protocol bids, commitments, and payments, so no builder or relay can pry a block open the way the brothers did (ethereum.org).
Ethereum co-founder Vitalik Buterin has long argued for enshrining this separation precisely so that the centralizing pressure of block building does not spread into the validator set itself (Ethereum Research). A companion proposal, fork-choice enforced inclusion lists (FOCIL, EIP-7805), lets a committee of validators force blocks to include transactions that builders might otherwise censor; developers pushed it to a later upgrade to avoid combining too many untested changes at mainnet scale at once. Together they aim to make censorship both visible and reversible.
Even enshrined PBS still asks validators to trust builders they do not run, the same tension that runs through any system built on outsourced computation, from block building to decentralized inference. The longer horizon points toward encrypted mempools, where transactions stay hidden until after their ordering is fixed, removing the very information a sandwicher needs. None of this makes MEV vanish; the goal is to redistribute it more fairly and strip out the coercive forms.
What This Means for Traders and Regulators
For an ordinary trader, the practical takeaways are short. Route swaps through a protected RPC or a batch-auction DEX, keep slippage tolerance as tight as the trade allows, and prefer aggregators or request-for-quote venues for large orders, where a market maker prices the whole trade rather than letting the mempool do it. These habits will not eliminate MEV, but they move you out of the easiest line of fire.
For regulators, MEV is largely uncharted ground. The first courtroom test came not from the SEC or the CFTC but from the DOJ, as wire fraud, and it ended in a hung jury. US securities and derivatives regulators have not brought an MEV-specific enforcement action, and the core question, whether reordering a public blockchain for profit is legitimate arbitrage or unlawful manipulation, remains genuinely open. What is clear is the direction of travel. MEV is being professionalized, measured, and slowly pulled into the protocol. It will not disappear, but the era of invisible, unaccountable extraction is ending.
Frequently Asked Questions
What is MEV in crypto?
MEV, or maximal extractable value, is the extra profit a block producer or the searchers working with it can earn by choosing which transactions to include and in what order. It comes from strategies like arbitrage, liquidations, and sandwich attacks, and on Ethereum it is a multi-million-dollar market that runs on every block.
Are MEV sandwich attacks illegal?
Sandwich attacks occupy a legal gray zone. No US regulator has declared them illegal, and they exploit public mempool data rather than stolen information. The one criminal case tied to MEV, against the Peraire-Bueno brothers, involved exploiting a relay with a false signature and ended in a mistrial in November 2025, so the law is still unsettled.
How can I protect my trades from MEV?
Use a private RPC such as Flashbots Protect or MEV Blocker so your transaction skips the public mempool, trade on a batch-auction DEX like CoW Swap where every order in a batch clears at one price, and keep your slippage tolerance tight. For large orders, aggregators and request-for-quote venues reduce your exposure further.
What is MEV-Boost?
MEV-Boost is open-source software from Flashbots that lets Ethereum validators outsource block building to a competitive market of specialized builders through relays. Most validators run it because the builder market pays more than they could earn assembling blocks themselves, which is why MEV meaningfully raises staking rewards.
Will ePBS end MEV on Ethereum?
No. Enshrined proposer-builder separation, expected with the Glamsterdam upgrade in 2026, removes the trusted relays that MEV-Boost depends on and brings the auction into the protocol, which reduces censorship and single points of failure. It redistributes MEV and makes it safer, but the underlying value of ordering transactions does not go away.
By Marcus Okafor, Senior Markets Editor at HOGE Wire, covering DeFi market structure and on-chain infrastructure.