How Not to Get Sandwiched: A 2026 MEV Defense Manual

On 30 April 2026, a trading bot called jaredfromsubway.eth wrapped itself around a token swap worth about four US dollars and pushed roughly 1.14 million dollars of WETH through the block to do it. The target was Vitalik Buterin. The co-founder of Ethereum, trading his own chain, was sandwiched by a bot the way any first-week DeFi user would be. He lost a few cents. The lesson was not the money. It was that nobody is too sophisticated, too early, or too famous to be prey.

This is a defense manual, not a tour of the zoo. HOGE Wire has covered the strategies, the market structure, and even the courtroom fights over whether any of this is legal. This piece answers the only question most readers actually care about: when you click swap, how do you stop a machine from reaching into your transaction and skimming it? The short version is that defense in 2026 is a stack, not a switch, and most of the stack is free. Think of it the way you would think about protecting a seed phrase or surviving a physical wrench attack on your keys: no single tool saves you, but a few layers combined make you a bad target.

MEV in One Minute: The Tax You Never Agreed to Pay

MEV stands for Maximal Extractable Value: the profit that whoever orders transactions in a block can capture by inserting, reordering, or censoring trades. On Ethereum the ordering right is sold through an auction, and specialized bots called searchers bid for the privilege of placing their transactions exactly where they are most profitable, usually right next to yours. The Ethereum Foundation’s own documentation describes the mechanics plainly: a searcher watches the public queue, spots a profitable trade, and pays to surround it.

The scale is not trivial. Cumulative extracted value on Ethereum has passed 1.2 billion dollars, and more than half of that came from sandwich attacks aimed squarely at ordinary swaps. The security researchers Dan Robinson and Georgios Konstantopoulos of Paradigm gave the environment its lasting name back in 2020: the mempool is a dark forest, a place where the moment you broadcast an unprotected transaction, something is watching and will eat it. Six years later the forest is bigger, the predators are faster, and the entry fee is still the same: hitting confirm on a public transaction.

One academic framing is worth keeping in your head as you read the rest of this guide. A trade’s visible cost (the liquidity-provider fee your DEX shows you) is only a slice of what you actually pay; a 2026 paper argues the displayed fee is only 28 to 36 percent of the true all-in cost of a typical DEX trade, with MEV and other implicit costs making up the rest. MEV is the part of the bill that never prints on the receipt.

The Three Attacks That Actually Target You

Most MEV strategies do not touch retail traders at all. Cross-exchange arbitrage, liquidations, and the latency games professional firms play against each other are either harmless to you or happen on venues you never see. Only a handful of strategies reach into a normal person’s swap. Know these three, because the entire defense stack is built to defeat them.

The sandwich is the one that drained Vitalik’s cents and far more from everyone else. A bot sees your buy order sitting in the public mempool, buys the same token just ahead of you (pushing the price up), lets your order execute at the worse price, then sells immediately after into the bump you created. You get filled; you just get filled at the top of a spike the bot manufactured. The bigger your slippage tolerance and the thinner the pool, the fatter the sandwich.

Front-running is the simpler cousin: a bot copies a profitable action it sees in your pending transaction (a big buy, an NFT mint, a governance-triggered trade) and simply does it first, capturing the move you were about to make. Just-in-time (JIT) liquidity is subtler and sometimes even helps you: a bot spots your large swap, adds concentrated liquidity in the exact tick range a single block before you trade, collects most of your fee, and withdraws the liquidity one block later. It is not stealing from your output so much as intercepting the fee a real liquidity provider would have earned. The same bots that run these plays can turn on each other, too; jaredfromsubway.eth, the most notorious sandwich bot of the cycle, was itself drained of about 7.5 million dollars in June 2026.

Why the Public Mempool Is the Danger Zone

Every defense in this guide follows from one idea, so it is worth stating clearly: the attack surface is the public mempool. When your wallet broadcasts a transaction through a default RPC endpoint, it lands in a public waiting room where it sits, visible to everyone, until a block is built. That waiting room is the hunting ground. Searchers run software that scans it continuously, simulates the profit of surrounding each pending trade, and bids for block position accordingly. Your transaction is not attacked after it confirms; it is attacked in the seconds it spends exposed and unconfirmed.

That single fact explains why the entire professional MEV supply chain exists. Around 90 percent of Ethereum blocks are now assembled through MEV-Boost, an out-of-protocol marketplace where builders compete to construct the most valuable block and validators simply sell the slot to the highest bid. The bots feeding that marketplace need to see your order to price it. So the master move in defense is almost insultingly simple: do not let them see it. Keep your transaction out of the public mempool and most of the attacks in the table above become impossible, because there is nothing to react to. The rest of this manual is a tour of the different ways to stay invisible, ranked roughly from easiest to most complete.

Defense Layer One: Private RPCs

The single highest-impact change most readers can make takes about two minutes: switch the RPC endpoint in your wallet from the public default to a private, MEV-protected one. An RPC endpoint is just the address your wallet uses to send transactions to the network. The public ones dump your trade straight into the open mempool. A private one routes it through a sealed channel to block builders, skipping the public waiting room entirely. No visibility, no sandwich.

The two endpoints most readers should know are Flashbots Protect and MEV Blocker. Flashbots Protect routes your transaction into a private Flashbots mempool where, in its own words, it is hidden from front-running and sandwich bots. The endpoint is rpc.flashbots.net/fast. It carries two underrated bonuses: it does not log your IP or location, and you do not pay gas on transactions that fail, because failed trades are simply never included rather than mined and wasted. MEV Blocker, run by the CoW DAO and partners, works similarly from the user’s side; you point your wallet at rpc.mevblocker.io and your trades stop appearing in public. Both are free, and adding either is a matter of pasting one URL into your wallet’s network settings.

Which of the two to pick comes down to philosophy more than performance. Flashbots Protect leans on the Flashbots builder and its MEV-Share auction, so it is the natural choice if you want the deepest integration with the largest order-flow network. MEV Blocker was designed as neutral, multi-searcher infrastructure by the CoW DAO specifically to avoid tying users to any single builder, and it exposes several endpoint variants (a standard one, a no-reverts option, a full-privacy option) so you can tune how aggressively it protects versus how reliably your trades land. For most people either is a dramatic upgrade over a public RPC; the meaningful decision is to use one at all.

There is a nuance worth understanding rather than glossing over. These endpoints do not make your transaction literally invisible to everyone; they make it invisible to the public mempool while handing it to a specific set of builders and searchers under rules that forbid front-running and sandwiching. You are trading open exposure for a narrower, rule-bound exposure. That is a very good trade, but it means you are now trusting the operator of the endpoint to behave. It is the same trust-layer bargain that now runs through everything in crypto, from code audits to custody; whoever sits in the privileged position has to be trusted not to abuse it, which is exactly why neutral infrastructure keeps turning into a trust layer that other people have to vouch for.

Defense Layer Two: Get Paid for Your Own Order Flow

Hiding your trade stops the harmful MEV. The next layer goes further: it captures the benign MEV your trade still creates and pays it back to you. Your transaction often leaves a harmless arbitrage opportunity behind it (a tiny price gap a backrunning bot can close in the same block). That value is real, and historically it went entirely to the searcher and the validator. Order-flow auctions (OFAs) flip that. They let searchers bid to backrun your trade, forbid them from front-running or sandwiching it, and rebate most of the winning bid to you.

The numbers are concrete. MEV Blocker runs exactly this auction and splits the proceeds 90 percent to the user and 10 percent to the validator; by its own published metrics it has protected more than 219 billion dollars of transaction volume across over 62 million transactions, rebated more than 5,500 ETH to users, and shows a median rebate around 26 dollars. Flashbots offers the same idea through MEV-Share, launched in April 2023, which by default returns 90 percent of the eligible MEV a transaction creates to the user, with Flashbots taking no cut. The refund lands automatically at the address that sent the trade.

Two caveats keep this honest. First, the rebate is a share of the MEV your trade happens to create, not a return on the trade itself; many swaps create little or none, so do not expect a check every time. Second, the whole model is a redistribution fight, not a cure. Flashbots itself framed its original order-flow research under the banner of trying to illuminate the order flow, precisely because the value was being captured in the dark by a shrinking set of players. OFAs move some of that value back to users, but they also create a new intermediary (the auction operator) that sees everything. That is a theme we return to near the end.

Defense Layer Three: Intents and Batch Auctions

The strongest form of protection does not hide your transaction; it changes what a transaction even is. Intent-based trading lets you sign a statement of what you want (sell X for at least Y) rather than a specific path through a specific pool. A competitive network of solvers then fights to fill that intent on the best terms, and they, not you, bear the execution risk. Because you never broadcast an exploitable swap, there is nothing in the mempool to sandwich.

Three systems dominate. CoW Swap batches orders together and settles them at a single uniform clearing price, which structurally kills the sandwich: if everyone in a batch gets the same price, there is no profitable gap to insert a trade into. Better still, when two traders in one batch want opposite sides of the same pair, solvers match them directly in a coincidence of wants, with no pool and no fee leakage at all. According to a Bitquery investigation, CoW Swap settled about 23.3 billion dollars across 2.34 million settlements in 2026, with roughly 32 solvers competing on Ethereum. UniswapX uses a Dutch auction filled by professional fillers from their own inventory; because the filler takes the price risk, an order that gets filled cannot be sandwiched, and any positive price movement is returned to the trader. 1inch Fusion blends a request-for-quote model with a Dutch auction to similar effect.

The trade-off with intents is that you hand execution to a solver and trust the auction to be competitive. In exchange you get the cleanest protection available to a normal user, which is why intent-based DEXs have become the default recommendation for any swap large enough to be worth a bot’s attention.

Slippage, Deadlines, and the Settings You Actually Control

Even with a private RPC, the parameters you set on each trade decide how much a bot could take if your transaction ever did get exposed (through a misconfigured wallet, a bridge, or a venue that still uses the public mempool). The most important dial is slippage tolerance. Slippage is the maximum price movement you will accept between signing and settling. It exists for a real reason: prices move. But a sandwich bot’s entire profit is capped by your slippage setting, because it can only push the price as far as your tolerance allows before your trade reverts. Set slippage to 5 percent on a thin token and you have told every bot in the forest that you will absorb a 5 percent manufactured spike without complaint.

Practical rules follow directly. Keep slippage as tight as the pool allows, often well under 1 percent for liquid pairs, and only loosen it deliberately for genuinely volatile or illiquid tokens. Prefer deep liquidity pools, because a large pool moves less on your trade and leaves a smaller sandwich margin. Split very large orders into pieces, or route them through an intent DEX that does the splitting for you. Set reasonable transaction deadlines so a trade that sits unconfirmed expires rather than executing minutes later into a price that has moved against you. And treat any token with a tiny pool and a huge advertised yield as a place where MEV is the least of your worries.

Wallets have started doing some of this for you. Several major wallets now default to MEV-protected routing or surface a private-transaction toggle, so a growing share of users are protected without ever reading a guide like this one. Check whether yours does; if it offers an MEV-protection or private-RPC setting, turn it on and leave it on. The goal is to make protection the boring default, not a thing you remember to do only on big trades.

Choosing Your Battlefield: L2s and App-Level Ordering

Where you trade matters as much as how. On Ethereum mainnet the ordering right is auctioned to builders. On most layer-2 rollups, a single sequencer orders transactions, and for now that sequencer generally keeps trades private until they are batched, which removes the public-mempool hunting ground almost by accident. That is one reason retail sandwiching is rarer on Arbitrum, Base, and Optimism than on mainnet: there is no open queue to watch. The flip side is that the sequencer itself becomes the ordering monopoly, and the value that used to go to searchers can accrue to whoever runs it.

A newer and more interesting defense is application-level ordering, where the app that creates the MEV also controls the ordering and returns the proceeds to its users. Angstrom, built by Sorella Labs as a Uniswap v4 hook, runs an app-specific auction that captures the arbitrage a pool would otherwise leak and redistributes it back to liquidity providers. Unichain uses trusted-execution-environment priority ordering toward the same end. Uniswap’s own UNIfication proposal pushes further, selling temporary fee advantages and burning the proceeds. The common thread is that these designs stop treating MEV as something done to users and start treating it as revenue the protocol can recycle. For a defender, the takeaway is simple: venues that internalize their own MEV are structurally safer than venues that leak it into an open auction.

The Solana Playbook

Solana traders live in a different threat model, and the defenses differ with it. Solana has no global public mempool in the Ethereum sense; transactions are forwarded to the current leader rather than sitting in a shared queue. That removes the classic open-queue sandwich, but it does not remove MEV. Most Solana stake runs the Jito-Solana client, which auctions off-chain bundles and tips so searchers can pay for favorable placement, and sandwiching migrated into those private channels and into validators who ran their own hidden mempools.

The ecosystem’s response was unusually blunt. The Solana Foundation removed more than 30 validators from its delegation program in 2024 for running sandwich mempools against retail users, cutting off the stake-delegation subsidy that kept many of them profitable. Tim Garcia, who leads validator relations at the Solana Foundation, framed the enforcement as a permanent line rather than a one-off warning when the purge was reported. For a Solana trader, the practical defenses are to route swaps through aggregators and front-ends that use Jito bundles or private submission, to set tight slippage exactly as on Ethereum, and to prefer apps that have adopted anti-sandwich routing. The chain is less of an open forest, but it is not a safe one.

What You Still Cannot Defend Against

An honest manual admits its limits. Some MEV is simply not yours to stop, and some of your defenses carry hidden costs. Start with the biggest category of extraction, which you cannot touch because it does not target you at all: non-atomic CEX-DEX arbitrage, where professional firms trade the gap between a centralized exchange price and an on-chain pool. An academic study measured 233.8 million dollars of this value from 7.2 million arbitrages by just 19 searchers over 19 months. It is the darkest corner of the forest, it dwarfs sandwich revenue, and no slippage setting or private RPC changes it, because the arbitrage is a consequence of markets being in two places at once, not an attack on your specific trade.

Then there is the uncomfortable cost of your own defenses. Routing through private RPCs and order-flow auctions concentrates trades into a small number of builders and relays. The live picture is stark: in the 24 hours around publication, relayscan.io showed Titan building about 52 percent of MEV-Boost blocks, Quasar about 23 percent, and Eureka and BuilderNet around 10 percent each, meaning the top three construct roughly 85 percent of blocks. Robert Miller, a product lead at Flashbots, has argued for years that order-flow auctions return value to users but risk turning their off-chain operators into a new point of centralization, a tension he raised when Flashbots first proposed the matchmaker model. The defense that keeps a bot out of your trade also feeds the very concentration that worries the people who built the defense.

Censorship is the other structural limit. After US sanctions hit the Tornado Cash mixer in 2022, a meaningful share of relays began filtering sanctioned addresses, and the proportion of blocks built by OFAC-compliant relays is tracked publicly at mevwatch.info. As a trader you do not choose which relay carries your transaction, so you inherit whatever inclusion policy the dominant builders happen to run that day. Private routing can quietly help here, since your transaction skips the public queue where censoring parties watch, but it is not a lever you control, and it is a reminder that the plumbing beneath your trade has politics of its own.

Finally, the end of the supply chain is invisible to you entirely. Whatever MEV survives all of this is ultimately captured by block proposers, which increasingly means large staking operations and the custodians behind spot ETFs. The question of who actually stakes the ETFs’ Ether, and therefore who pockets the MEV premium on top of base staking yield, is its own structural story; for a defender it is a reminder that you are one small participant in a value chain that extends far past your wallet.

Figures are a live 24-hour snapshot and move daily, but the shape (a top-three controlling the overwhelming majority of blocks) has held all year.

The Protocol-Level Cavalry: ePBS, FOCIL, and Encrypted Mempools

The defenses above are things you do. The most durable fixes are things the protocol does, and they are arriving. Ethereum’s next upgrade, Glamsterdam, carries enshrined proposer-builder separation (ePBS, specified in EIP-7732) as its headline change. ePBS pulls the builder auction into the consensus protocol itself, so the trusted relay middleware that sits between proposers and builders today is no longer required. The upgrade activated on the Sepolia testnet on 6 October 2026 and is scheduled to hit the Hoodi testnet on 26 October 2026, according to the Ethereum Foundation’s announcement; a mainnet date will be set by client teams once testing holds.

Crucially, ePBS alone does not fix the thing that hurts you. It reorganizes who trusts whom at the end of the pipeline; it does not stop a builder from ordering your trade against you. Vitalik Buterin said as much in a March 2026 plan to curb builder centralization, arguing that ePBS by itself is insufficient and that Ethereum also needs inclusion lists (the FOCIL design, EIP-7805) to resist censorship and, eventually, encrypted mempools so that builders cannot read the content of transactions they are ordering in the first place. Encrypted mempools are the real endgame for retail defense: if the builder literally cannot see what your transaction does until it is already committed, the sandwich becomes impossible at the protocol level rather than the wallet level. That technology is still maturing, and it rhymes with the broader push to prove things without revealing them that runs through cryptographic systems well beyond trading. Until it ships, the manual stands.

Do Not Count on the Courts

A reasonable reader might ask why any of this is legal, and whether the law will eventually do the defending for them. The honest answer in 2026 is that the legal status of predatory MEV is genuinely unsettled, which is exactly why self-defense remains the only reliable protection. The first criminal MEV case, against the brothers Anton and James Peraire-Bueno, ended in a mistrial in late 2025 after a jury deadlocked, and a retrial cannot begin before late 2026; we have told that story in full in MEV on Trial. The core dispute (whether exploiting the ordering rules is fraud or simply using a permissionless system as designed) has no settled answer.

The regulatory picture is no more comforting for a would-be victim. Anonymous bots running on permissionless DEXs sit largely outside the market-abuse perimeter that the SEC applies to registered intermediaries, a gap that persists even as the agency shifts toward writing rules instead of filing lawsuits. Washington has a crowded crypto agenda, and market structure keeps climbing the priority list, but none of it yet reaches the bot that sandwiches your swap. Treat the legal system as a backstop that may arrive years from now, not as a reason to skip the two-minute RPC change today.

A Five-Minute Defense Checklist

If you read nothing else, do these, in order. Each takes minutes and most are free.

• Switch your wallet’s RPC to a private, MEV-protected endpoint (Flashbots Protect or MEV Blocker). This is the single biggest win.
• Use an intent-based DEX (CoW Swap, UniswapX, or 1inch Fusion) for any swap large enough to be worth a bot’s attention.
• Set slippage as tight as the pool allows, and only loosen it deliberately for volatile or illiquid tokens.
• Prefer deep-liquidity pools and split very large orders, so there is a smaller margin for anyone to extract.
• Turn on your wallet’s built-in MEV-protection toggle if it has one, and leave it on by default.
• On Solana, route through front-ends that use Jito bundles or private submission, and keep slippage tight.
• Remember the limits: CEX-DEX arbitrage and the builder oligopoly are structural, not personal, and no setting fixes them.

Defense against MEV is not about outsmarting the fastest bots in the world. It is about refusing to broadcast an exploitable transaction in the first place. The forest is still dark, but in 2026 you no longer have to walk through it carrying a torch and shouting your position. Most of the tools cost nothing, take minutes, and quietly move you from the menu to the sidelines. Even the person whose name is on the chain gets sandwiched when he forgets them; the difference is that now, you do not have to.

Frequently Asked Questions

What is the easiest way to protect my trades from MEV?

The single highest-impact step is switching your wallet’s RPC endpoint to a private, MEV-protected one such as Flashbots Protect (rpc.flashbots.net/fast) or MEV Blocker (rpc.mevblocker.io). Both are free, take about two minutes to set up, and keep your transaction out of the public mempool where sandwich bots hunt.

What is a sandwich attack in crypto?

A sandwich attack is when a bot spots your pending buy order in the public mempool, buys the same token just before you to push the price up, lets your order fill at the inflated price, then sells immediately after into the spike it created. You still get filled, just at a worse price, and the bot keeps the difference.

Does a private RPC or MEV protection cost anything?

No. Flashbots Protect and MEV Blocker are both free to use, and MEV Blocker even rebates about 90 percent of the benign backrunning value your trade creates back to you. Flashbots Protect also waives gas on failed transactions, since they are never included rather than mined and wasted.

Can intent-based DEXs like CoW Swap really stop sandwiching?

Largely, yes. CoW Swap settles batches at a single uniform clearing price, which removes the price gap a sandwich needs, and UniswapX fills orders from a filler’s own inventory so a filled order cannot be sandwiched. You trade some execution control to a solver network in exchange for structural protection, which is why intents are the default recommendation for larger swaps.

Will ePBS or the Glamsterdam upgrade end MEV?

Not by itself. Glamsterdam’s enshrined proposer-builder separation (EIP-7732) removes trusted relay middleware but does not stop a builder from ordering your trade against you. The fixes that would actually end retail sandwiching, inclusion lists (FOCIL) and encrypted mempools, are still being developed, so the defenses in this guide remain necessary for now.

Yuki Tanaka is HOGE Wire’s DeFi correspondent, covering on-chain markets, MEV, and the plumbing of decentralized finance.