The MEV Oligopoly in 2026: Who Profits in the Dark Forest

Every time you swap a token on a decentralized exchange, your trade joins a queue you cannot see, inside a market you were never invited to. Before it settles, specialized software has already read it, priced it, and decided whether there is money to be made by placing other trades around it. That money has a name: Maximal Extractable Value, or MEV. In 2026 it is no longer a curiosity at the edge of DeFi. It is an industry.

The early story of MEV was about lone bots and clever tricks. The current story is about market structure. A small number of vertically integrated firms now dominate the strategies that actually make money, and the gap between an amateur with a script and the handful of professional operators at the top has become close to unbridgeable. The single most profitable strategy is one most traders have never heard of. And on 6 October 2026, Ethereum ran a testnet fork that begins to rewire the whole machine.

This is a field guide to how value is extracted on-chain in 2026: the strategies, ranked by how much they earn rather than how often they are discussed; the assembly line that turns a strategy into a block; and the concentration of power that has quietly turned a permissionless game into something that looks a lot like an oligopoly. Ethereum, a network worth roughly $305 billion and trading near $2,500 as this was written, settles most of the activity described below (CoinGecko). Figures are current as of publication and, in a market this fast, should be read that way.

What MEV Is, in One Paragraph

MEV is the profit a block producer, or someone paying a block producer, can capture by choosing which transactions enter a block and in what order. Because a blockchain’s ordering is not neutral, the right to sequence transactions is itself worth money. The term was coined in the research paper Flash Boys 2.0, where it stood for Miner Extractable Value; after Ethereum moved to proof-of-stake and miners stopped building blocks, the M was quietly rebranded to Maximal. The Ethereum Foundation’s own developer documentation frames it simply: MEV is value extracted by reordering, inserting, or censoring transactions within a block. Everything that follows is a variation on that one idea.

From Dark Forest to Industry: A Short History

In August 2020, Paradigm researchers Dan Robinson and Georgios Konstantopoulos published an essay that named the problem for a generation of developers: “Ethereum is a Dark Forest.” Their point was that the public mempool is a predatory environment where any profitable transaction you broadcast can be seen and front-run by bots before it confirms. At the time, MEV was mostly the work of independent arbitrageurs, and the dark forest was still a wilderness.

Six years later, the wilderness has been developed. The 2022 merge to proof-of-stake formalized proposer-builder separation, and specialized builders, relays, and professional searchers turned opportunistic front-running into a supply chain with distinct, monetizable roles. The lone bot did not vanish; it was outcompeted. What used to be a free-for-all is now a mature market with incumbents, barriers to entry, and a recognizable power law, in which a few firms capture most of the value and everyone else fights over scraps. The rest of this article maps that market, strategy by strategy and role by role.

Atomic vs Non-Atomic: The Divide That Explains Everything

Older explainers list MEV strategies like dishes on a menu: arbitrage, sandwiches, liquidations, and so on. That catalog still matters, and this article walks through it. But the distinction that actually explains who profits in 2026 is rarely spelled out: is the strategy atomic or not?

An atomic strategy lives entirely on one chain, inside one bundle of transactions. If any leg fails, the whole thing reverts and the searcher loses only gas. DEX-to-DEX arbitrage and most liquidations are atomic, which makes them almost risk-free: a failed attempt costs pennies. A non-atomic strategy has a leg that settles somewhere the blockchain cannot guarantee, almost always a centralized exchange. A searcher buys an asset cheaply on a DEX and sells it on a venue like Binance or Coinbase seconds later; the on-chain leg is atomic, but the off-chain leg carries real price risk in the gap between the two fills. That risk is exactly why non-atomic MEV is the professionals’ game, and why it is the largest and least visible category of all. Hold that distinction in mind; it is the key to the table below.

CEX-DEX Arbitrage: The Dark Forest’s Darkest Corner

If you measure MEV by headlines, sandwich attacks win. If you measure it by dollars, the crown belongs to a strategy that leaves almost no trace on-chain: arbitrage between centralized and decentralized exchanges. The definitive study of this corner, presented at the 2025 Advances in Financial Technologies conference under the apt title The Darkest of the MEV Dark Forest, measured it directly. Over roughly nineteen months, just 19 searchers extracted about $233.8 million from more than 7.2 million CEX-DEX arbitrages on Ethereum. Those trades occupied less than 2% of block space yet contributed more than 15% of total block value. For the period studied, non-atomic CEX-DEX extraction outgrew the entire atomic-MEV category combined.

The reason you never see it is structural. A sandwich leaves two mirror-image swaps wrapped around a victim, legible to anyone with a block explorer. A CEX-DEX arbitrage leaves a single, innocuous-looking swap; the profit is realized on an exchange’s internal ledger that no chain records. The dashboards that quantify sandwiching, such as EigenPhi, cannot see most of this activity at all, which is why it stayed off the public radar for years even as it became the main event. The searcher takes on genuine inventory risk, holding the asset across the seconds between the on-chain buy and the off-chain sell, and gets paid for absorbing that risk the way any market maker does.

It is also relentlessly concentrated. The study found the top three searchers capturing roughly three-quarters of volume and value, rising to about 90% of extracted value by early 2025. The names clearing the most notional are professional trading firms: Wintermute, SCP, and an operator the researchers label Kayle. Their edge is latency and inventory, not clever smart-contract code, which is precisely why a retail participant can never compete here. This is where market makers who grew up in traditional high-frequency trading meet the chain, and the on-chain economy where spot and perpetual futures both trade looks more like Wall Street every quarter. For the venue side of that convergence, see our guide to how perp DEXs work.

Sandwich Attacks: The Strategy Everyone Can See

If CEX-DEX arbitrage is the quiet giant, the sandwich is the loud villain. The mechanics are simple and predatory. A bot spots a pending swap large enough to move a pool’s price, buys the same asset first to push the price up, lets the victim fill at the worse rate, then sells immediately afterward. The victim’s slippage becomes the bot’s profit. Nothing about it improves the market; it is a pure transfer from an uninformed trader to a fast one.

Sandwiches dominate the conversation because they are both visible and clearly extractive. Industry trackers have attributed roughly half of all cumulative Ethereum MEV to sandwiching, with total extracted MEV generally estimated in the low billions of dollars, though every such figure varies by methodology and is best read as an order of magnitude rather than a precise number (DEXTools).

No bot embodies the genre like jaredfromsubway.eth. In April 2026 it sandwiched a roughly $4 token swap made by Vitalik Buterin himself, surrounding the tiny trade with more than a million dollars in volume, a stunt that proved nobody is too prominent to be sequenced (CoinDesk). The irony arrived two months later: in June 2026 the bot itself was drained of about $7.5 million in a counter-MEV trap, a reminder that predators in the dark forest are not immune to being preyed upon (CoinDesk).

Arbitrage, Liquidations, and the Long Tail

Not all MEV is a tax. Two of the most common strategies make markets work better rather than worse. Plain DEX-to-DEX arbitrage is the oldest form: when the same asset trades at different prices across pools, a searcher buys low on one and sells high on another in a single atomic bundle, pocketing the spread and dragging the two prices back into line. The Ethereum Foundation’s documentation uses a clean example, in which a pool is mispriced so that about 1,000 ETH can be swapped into a position worth roughly 1,045 ETH, and a bot captures the 45 ETH difference while restoring the correct price. Everyone who trades those pools afterward gets a fairer rate for it.

Liquidations are the other benign workhorse. Lending protocols such as Aave and Morpho require loans to stay over-collateralized; when a borrower’s collateral slips below the threshold, anyone can repay the bad debt and claim the collateral at a discount. The result is a gas-competitive race the instant a position crosses the line. It is MEV, but it is also the mechanism that keeps DeFi lending solvent, which is why liquidation bots are treated as infrastructure rather than parasites.

Beneath these sits a long tail of techniques that collectively move real money. Just-in-time (JIT) liquidity is the most elegant: a sophisticated provider watches for a large incoming swap, adds a huge, tightly concentrated position one transaction before it lands, collects the bulk of the trading fee, then withdraws immediately after, leaving passive providers who left capital in the pool overnight with almost nothing. Backrunning places a transaction right after a target to capture a predictable consequence, such as the arbitrage opening created by someone else’s large swap; unlike a sandwich, a pure backrun does not harm the original trader, which is why order-flow auctions try to turn it into a user rebate. The remaining long tail runs from NFT-mint sniping to one-off contract quirks: wherever code creates a first-come advantage, a bot will contest it.

Cross-Domain MEV and the Reorg Threat

The most dangerous MEV is the kind that threatens the chain itself. Cross-domain MEV spans multiple chains or rollups at once: a price dislocation between Ethereum, an L2, and a centralized venue can be captured only by an actor coordinating across all three, and every new bridge or rollup adds another domain to arbitrage. Researchers increasingly treat cross-chain arbitrage as the next frontier of extraction precisely because the surface keeps expanding.

The genuinely systemic risk is the time-bandit, or reorg, attack. If the MEV sitting in a past block is large enough, a rational validator might be tempted to re-mine history to steal it, reorganizing the chain rather than extending it. The original Flash Boys 2.0 paper warned that this dynamic could destabilize consensus itself, turning MEV from a user problem into a security problem. In practice, Ethereum’s economic finality and the dominance of the MEV-Boost market have kept deep reorgs rare, but the threat is the reason MEV is treated as core protocol business and not merely a DeFi nuisance.

The Assembly Line: Searcher, Builder, Relay, Proposer

To see who profits, you have to see the pipeline a strategy travels through. Modern Ethereum runs on proposer-builder separation, implemented off-protocol by Flashbots’ MEV-Boost software, which the vast majority of validators run. A trade becomes a block through four roles, each a link in a one-directional chain.

The flow runs one way: searchers send bundles to builders, builders submit blocks to relays, relays offer the highest bid to the proposer, and the proposer blindly signs. The proposer does not see the block it is signing, which is what makes the relay necessary and, as the next section shows, what makes the relay a problem.

Vertical Integration and the Builder Oligopoly

Here the 2026 story diverges sharply from the permissionless ideal. Block building has consolidated into something close to a duopoly. As this was written, live data from relayscan.io showed a single builder, Titan, producing a little over half of all MEV-Boost blocks, with a fast-rising newcomer, Quasar, taking roughly another quarter. Together, two builders assemble around three-quarters of Ethereum’s blocks; add the collaborative BuilderNet and the top three account for the overwhelming majority. These shares move daily, but the shape, a few builders and a very long tail of also-rans, has held all year.

Source: relayscan.io, 24-hour snapshot as of publication; shares fluctuate day to day.

Concentration alone would be worrying. The deeper problem is vertical integration. The most profitable searchers no longer sell their flow to independent builders; they are the builders, or are exclusively tied to one. The CEX-DEX study found this directly: neutral searchers who spread bundles across many builders keep higher margins, while exclusive searchers hand most of their extracted value to an affiliated builder, sometimes running at a paper loss precisely because the profit is booked on the builder side of the same company. Flashbots has warned since 2024 that this loop, in which a builder that also searches can guarantee its own bundles win, is a structural risk to MEV-Boost.

For independent searchers, the economics have turned brutal. In the CEX-DEX data, the firms clearing the largest notional volume post some of the thinnest margins, with median profit per trade sitting only a few dollars above zero. Competition has compressed the spread on every well-known opportunity to almost nothing, so the only way to stay profitable is scale, speed, and integration, the very forces that produced the oligopoly. The amateur who ran a profitable arbitrage bot from a laptop in 2021 has been priced out by firms that treat MEV the way an equities market maker treats rebates: a razor-thin per-trade margin multiplied by enormous volume. Structurally, it looks a great deal like payment for order flow in traditional markets, where the real money is in owning the flow rather than in any single trade (SSRN). The winner of the MEV game is no longer the cleverest bot; it is the firm that owns the most of the pipeline.

Fighting Back: Private Flow, Auctions, and Batches

If MEV is extracted from the gap between when you broadcast a trade and when it settles, every defense works by closing that gap. Three layers matured over 2026. The first is going private. Instead of broadcasting to the public mempool where any bot can read it, a trade is sent through a protected channel such as MEV Blocker, which routes it to builders without exposing it to sandwichers and refunds most of any backrun profit to the user (CoW DAO documentation). The trade-off is that you are now trusting the private relay not to peek; the protection is real, but it swaps one trust assumption for another. Many wallets now default to this kind of routing, often without the user noticing, a shift we examined in our look at how 2026 wallets spend on your behalf.

The second layer is the order-flow auction. Rather than let backrunning value leak to whoever is fastest, an auction sells the right to backrun your transaction and returns the proceeds to you. Flashbots’ MEV-Share pioneered the model; the trade-off, which Flashbots itself acknowledges, is that the auction operator becomes a new point of centralization. The third layer is batch execution. CoW Protocol settles trades in batches at a single uniform clearing price, which structurally removes the ordering advantage a sandwich depends on: if everyone in the batch clears at the same price, there is no slippage to steal. Application-level designs go further still; Uniswap’s UNIfication and app-specific sequencers such as Angstrom try to recapture ordering value for a protocol’s own liquidity providers instead of leaking it to outside searchers.

A fourth front is collaborative building. BuilderNet, a multi-operator network run inside trusted hardware by Flashbots, Beaverbuild, and Nethermind, pools order flow and returns value proportionally, with the stated aim of giving independent searchers the same financial outcomes and privacy that integrated searcher-builders enjoy today. Whether a shared builder can out-compete a vertically integrated one is the open question of the year. Smart accounts add yet another layer: the rise of intent-based trading and delegated execution, which we covered in our piece on account abstraction in 2026, pushes more order flow into systems that route around the public mempool by default.

MEV on Solana: No Mempool, Same Game

Ethereum is not the only chain with an ordering economy. Solana has no global mempool, which was supposed to make front-running impossible; in practice it moved the game rather than ending it. Most Solana validators run the Jito-Solana client, which recreates a sealed auction: searchers submit bundles with tips, and validators include the highest-paying ones (Chainstack). Those tips are recycled into the JitoSOL liquid-staking token, turning MEV into staking yield much as MEV-Boost does on Ethereum. Solana itself trades near $109, for a market value of about $64 billion (CoinGecko), and its MEV economy has scaled with it.

Solana has drawn a harder line on sandwiching than Ethereum. In 2024 the Solana Foundation removed dozens of validators from its delegation program for running private mempools that enabled sandwich attacks on retail, a purge the foundation’s validator-relations lead, Tim Garcia, described as final (CryptoSlate). By 2026, Jito’s block-building marketplace, known as BAM, had grown to roughly a third of Solana stake, and the economics look increasingly familiar (Solana Compass). Whoever controls the dominant client controls the ordering, and the same concentration pressures that shaped Ethereum are plainly visible here.

The ePBS Inflection: What Glamsterdam Changes

The relay is the weakest link in Ethereum’s current design. It is a trusted off-protocol middleman: it holds a builder’s block, shows the proposer only a bid, and is meant to release the full block only after the proposer commits. When that trust breaks, money moves. In April 2023 a validator exploited exactly this handoff, getting a relay to release a block body before its header was validated, then rebuilding the block to break the sandwiches inside it and walking off with roughly $20 million (Flashbots post-mortem).

Ethereum’s answer is to move proposer-builder separation into the protocol itself. The upcoming Glamsterdam upgrade is headlined by EIP-7732, enshrined proposer-builder separation (ePBS), which, in the Ethereum Foundation’s words, removes off-protocol trust assumptions and reliance on third-party relays by formally splitting the proposer’s job from the builder’s and stretching the block-propagation window from about 2 seconds to roughly 9 (ethereum.org). Glamsterdam forked on the Sepolia testnet on 6 October 2026, with mainnet expected in the fourth quarter but not yet dated, so none of this is live money yet.

Enshrining the auction removes the relay, but it does not touch the oligopoly. Vitalik Buterin has argued that ePBS alone is not enough, because synchronous shared state still pushes block building toward a few powerful actors; his 2026 roadmap pairs it with a Big FOCIL inclusion-list mechanism (EIP-7805) to force censorship resistance, plus encrypted mempools and anonymized routing to blind searchers in the first place (CoinDesk). The protocol can delete the middleman. Deleting the oligopoly is a much harder problem, and for an ordinary user nothing about the experience of swapping a token will look different the day ePBS ships.

Is MEV Legal? The Peraire-Bueno Test

For years the industry assumed MEV sat in a legal vacuum: distasteful, perhaps, but not illegal. A case moving through the federal courts in New York is testing that assumption. Anton and James Peraire-Bueno, two MIT-educated brothers, were charged with wire fraud and money laundering for allegedly exploiting a flaw in MEV-Boost to spy on and poison a block of pending transactions, extracting about $25 million in roughly twelve seconds in 2023. Their first trial ended in a hung-jury mistrial in late 2025, and prosecutors moved to retry them in early 2026 (The Block). The central question, whether exploiting the MEV supply chain is fraud or merely aggressive play in an adversarial system, remains unresolved, which is itself telling.

The deeper regulatory gap is structural. The U.S. Securities and Exchange Commission can reach a registered intermediary that front-runs its own customers, and market-manipulation statutes clearly apply to anyone who controls a trading venue. But an anonymous searcher running a bot against a permissionless DEX sits outside almost every existing perimeter: there is no broker, no customer relationship, and often no identifiable person. The European Union’s market-abuse regime under MiCA runs into the same wall, as our coverage of MiCA’s shift from rulemaking to enforcement describes. Regulators can police the on-ramps and the licensed firms; the dark forest itself remains, for now, beyond their reach.

What This Means for Traders

You cannot opt out of living in a sequenced world, but you can stop volunteering to be the victim. For an ordinary trader, the realistic goal is not to profit from MEV but to leak as little of it as possible, and a few habits do most of the work.

• Route trades through a protected or private channel rather than the public mempool; most major wallets now offer this, and many enable it by default.
• For larger swaps, use a batch-auction venue such as CoW Protocol, which clears everyone at one price and removes the sandwich vector entirely.
• Set a tight slippage tolerance, which caps how much a bot can steal even if your trade is seen.
• Split a very large order into smaller pieces to reduce the price impact that makes you worth attacking in the first place.

What you cannot do is out-run the professionals at their own game. The CEX-DEX engine that captures most of the value is a contest of latency and inventory between firms with co-located servers and nine-figure balance sheets. For everyone else, the thing to watch through the rest of 2026 is not any single strategy but the structure: whether ePBS, FOCIL, encrypted mempools, and collaborative builders can pry the pipeline back open, or whether the oligopoly that now runs the dark forest simply migrates into the protocol and settles in.

Frequently Asked Questions

What is MEV in simple terms?

MEV, or Maximal Extractable Value, is the profit someone can make by choosing which transactions go into a blockchain block and in what order. Because ordering is valuable, specialized bots and firms pay to insert, reorder, or exclude trades for gain. It was originally called Miner Extractable Value and was renamed after Ethereum moved to proof-of-stake.

What is the most profitable MEV strategy?

By dollars extracted, CEX-DEX arbitrage, which exploits price differences between decentralized and centralized exchanges, is the largest category on Ethereum. A 2025 academic study found 19 searchers extracted about $233.8 million from more than 7.2 million such trades, with the top three capturing roughly three-quarters of the value. Sandwich attacks are more visible but smaller in total.

How can I protect my trades from sandwich attacks?

Send trades through a private or protected channel such as MEV Blocker instead of the public mempool, use a batch-auction venue like CoW Protocol that clears all trades at one price, set a tight slippage tolerance, and break very large orders into smaller pieces. Many 2026 wallets enable protected routing by default.

Is MEV illegal?

There is no settled answer yet. Routine arbitrage and liquidations are generally seen as legitimate market activity, but a U.S. federal case against the Peraire-Bueno brothers over a $25 million MEV-Boost exploit is testing whether manipulating the MEV supply chain can be criminal fraud; the first trial ended in a mistrial in late 2025. Anonymous bots on permissionless exchanges largely sit outside existing securities and market-abuse rules.

Will Ethereum’s ePBS upgrade eliminate MEV?

No. The Glamsterdam upgrade’s EIP-7732 (ePBS) moves proposer-builder separation into the protocol and removes the trusted relay, which improves security and censorship resistance, but it does not stop value from being extracted or break up the concentration among a few large builders. Ethereum developers pair it with other measures such as inclusion lists and encrypted mempools to address those problems.

Yuki Tanaka covers DeFi and on-chain markets for HOGE Wire.