MEV in 2026: How On-Chain Value Is Extracted and Reclaimed
Maximal extractable value has become a full industry in 2026, with its own supply chain and arms race. Here are the strategies that extract MEV, and the tools now built to give it back.
In May 2026, an automated trading bot known as jaredfromsubway.eth committed roughly $1.14 million of wrapped Ether in order to earn about four dollars. Its target was a small token swap signed by Ethereum co-founder Vitalik Buterin, and the play was a textbook sandwich: buy just ahead of his trade, let his order nudge the price, then sell into it. CoinDesk covered the episode as proof that even the network’s founder trades in the same dark forest as everyone else (CoinDesk). Weeks later, in June, the same bot was drained of roughly $7.5 million after an attacker fed it a booby-trapped token and turned its own automation into a trap (CoinDesk).
Those two stories, a bot extracting value from a founder and then losing a fortune to a smarter predator, capture what maximal extractable value (MEV) has become in 2026: a mature, adversarial industry with its own supply chain, its own arms race, and, increasingly, its own effort to hand some of the value back. This guide maps the strategies that extract MEV, the machinery that routes it, and the fast-growing set of defenses and redistribution schemes that are quietly rewriting who keeps the money.
What MEV Actually Is, and Why It Never Goes Away
MEV is the profit that can be captured by choosing which transactions land in a block and in what order. On a public blockchain, pending transactions sit in a mempool where anyone can watch them before they confirm. Whoever assembles the next block decides the sequence, and sequence is money: front-running a large buy, slipping an arbitrage trade between two others, or racing to be first to liquidate an underwater loan are all just ways of monetizing ordering rights.
The term was coined in the 2019 research paper Flash Boys 2.0, whose authors (a group that included Phil Daian and Ari Juels) not only named the phenomenon but warned that competition to capture it could destabilize consensus itself, because a large enough prize gives block producers a reason to reorganize recent history rather than build honestly on top of it (arXiv). It originally stood for miner extractable value; after Ethereum retired mining in its move to proof of stake, the M was rebranded to maximal, and the idea now applies to any chain with a public transaction queue (ethereum.org).
The point that matters for anyone using DeFi is that MEV is not a bug that a patch will remove. As long as ordering has value and someone holds the power to set the order, that value will be captured by somebody. The only real questions are who captures it, how much leaks to predators rather than to productive actors, and whether any of it flows back to the users who created it.
That framing is the key to reading the rest of this guide. There are really two games being played on top of the same mempool. The first is extraction: the searchers, bots, and builders competing to capture ordering value, often at a trader’s expense. The second, newer and growing fast in 2026, is reclamation: the wallets, auctions, and applications competing to give that value back, or at least to route it to the people who generated it. Almost every tool below belongs to one game or the other.
The Extraction Playbook: A Field Guide to MEV Strategies
MEV strategies sit on a spectrum from benign to predatory. Some keep markets honest and cost ordinary traders nothing; others are a direct tax on whoever gets exploited. The table below sorts the major plays that searchers, the specialists who hunt these opportunities, run today.
| Strategy | How it works | Who pays | Benign or predatory |
|---|---|---|---|
| Arbitrage | Buys an asset cheaply on one venue and sells it dearer on another in a single transaction, closing the gap | No specific victim; the market absorbs it | Mostly benign |
| Liquidations | Repays an undercollateralized loan and claims the liquidation bonus, often after a gas-fee race | The liquidated borrower, via the penalty | Neutral to benign |
| Sandwich attacks | Buys just before a victim’s swap and sells just after, pocketing the price move the victim causes | The sandwiched trader, through a worse fill | Predatory |
| JIT liquidity | Adds concentrated liquidity moments before a large swap and pulls it right after, capturing the fee | Passive liquidity providers, through diluted fees | Contested |
| Backrunning | Places a transaction immediately after a target to capture a resulting opportunity, without harming the target | Usually no victim | Benign |
| Long-tail and NFT MEV | Sniping mispriced NFTs, mint races, token launches, and oracle updates | Slower participants or sellers | Mixed |
| Cross-domain MEV | Coordinates ordering across chains, rollups, or between a DEX and a centralized venue | Varies by venue | Emerging |
Arbitrage is the load-bearing beam of the whole system. When the same token trades at different prices on two automated market makers, a searcher can buy on the cheaper pool and sell on the richer one inside one atomic transaction, pushing both prices back toward each other and pocketing the spread. Ethereum’s own documentation uses this as the canonical example of value that is extractable yet broadly useful, because it keeps on-chain prices aligned with the wider market.
Liquidations play a similar cleanup role. Lending markets rely on bots, often called keepers, to repay the debt of borrowers who have slipped below their collateral threshold and to claim a discount on the seized collateral in return. That competition can clog the network with gas-bidding wars in volatile moments, but it is also what keeps lending protocols solvent, a dynamic that matters enormously to anyone borrowing on-chain, as we detail in our look at undercollateralized lending in 2026. The difference between these strategies and a sandwich is simple: arbitrage and liquidations extract value from a mispricing or a risk that already exists, while a sandwich manufactures a worse price for a specific person and takes the difference.
Sandwich Attacks: The Strategy Everyone Hates
A sandwich is the play that gives MEV its bad name. The bot watches the public mempool for a swap large enough to move a pool’s price, then wraps it: a buy order placed just ahead, which pushes the price up; the victim’s trade, which now fills at that worse price; and a sell order placed just behind, which cashes out the difference. The victim still receives their tokens, only at a measurably worse rate, and that gap becomes the attacker’s profit.
For years the emblem of this practice was jaredfromsubway.eth, a bot that at its peak was reckoned to sit behind a large majority of Ethereum sandwich attacks. Its brush with Vitalik Buterin was almost comic: it staked more than a million dollars of capital to squeeze a few dollars out of a tiny swap by the network’s most famous user (CoinDesk). The sequel was darker for the bot. In June 2026, an attacker built what researchers described as a counter-MEV honeypot, luring the bot into approving malicious helper contracts through fake tokens and pools, then using those approvals to drain roughly $7.5 million and route part of it through a mixer (CoinDesk). The lesson was that the same blanket token approvals that make bots fast also make them fragile, a failure mode we examine in our guide to private-key compromise.
Sandwiches are also the strategy the rest of the industry has organized to defeat, which is why so much of the defensive stack below is really about hiding your trade from bots like Jared, or stripping out the price-impact information they feed on.
The scale of this is not hypothetical. Analytics dashboards such as EigenPhi track sandwich activity block by block, and for a long stretch a single operator like Jared was reckoned to be behind the majority of it on Ethereum. The more encouraging trend is that as MEV-protected wallets and order-flow auctions have spread, the pool of naked, sandwichable transactions has shrunk, which is part of why even a once-dominant bot found rich pickings harder to come by in the months before it was finally trapped.
The MEV Supply Chain: Searcher, Builder, Relay, Proposer
Modern MEV is not a lone bot sniping trades. On Ethereum, where Ether traded near $2,470 with a market capitalization around $302 billion in September 2026 (CoinGecko), the whole business runs through a specialized assembly line created by proposer-builder separation (PBS), the design that splits the job of choosing a block’s contents from the job of proposing it. Value moves through four roles.
| Actor | What they do | How they capture value |
|---|---|---|
| Searcher | Scans the mempool and app state for profitable ordering, then bundles transactions to exploit it | Keeps the arbitrage, liquidation, or sandwich profit, minus bids |
| Builder | Assembles bundles and ordinary transactions into the most valuable block possible | Takes a margin between what searchers bid and what it pays the proposer |
| Relay | Sits between builders and proposers, holds the block until the proposer commits, and guarantees fair exchange | Usually runs at cost, as neutral infrastructure |
| Proposer (validator) | Selects the highest-paying block header and proposes it to the network | Receives the builder’s payment on top of issuance and fees |
Today more than 90% of Ethereum blocks are produced through MEV-Boost, the Flashbots-built software that runs this auction as an out-of-protocol marketplace (GitHub). The relay is the quiet linchpin here: it holds the block from the builder and releases the header to the proposer only once payment is guaranteed, which is what lets two parties who do not trust each other still trade a block for a fee. For validators, the payments that flow up this chain are a real and growing share of the return on staking, which is why MEV now appears as a line item in validator economics rather than as a curiosity. The searcher at the bottom does the hunting; the validator at the top captures a slice simply for holding the right to propose.
How Searchers Actually Work
Behind every extraction strategy is a searcher, and the craft is closer to engineering than to trading. A searcher runs software that watches the mempool and on-chain state for the instant an opportunity appears, simulates a candidate bundle of transactions against the current chain to confirm it will actually be profitable, and then submits that bundle to builders with a bid attached. Speed is everything, because the same opportunity is visible to every other searcher at the same moment, so the winner is usually whoever simulates fastest and bids highest.
On Ethereum, those bids flow through priority fees and direct payments to builders; on Solana, they take the form of tips attached to Jito bundles. Because the marginal opportunity is contested by many bots, profits are competed down toward the cost of the gas or tip needed to win, which is why the most sophisticated searchers chase an edge the rest cannot match: colocated infrastructure, faster simulation, private deals for order flow, or proprietary strategies nobody else has copied yet. It is a high-frequency trading business wearing on-chain clothes, and like its Wall Street cousin it rewards scale, which is one more force quietly pushing MEV toward concentration.
The Builder Bottleneck: Concentration, Censorship, and BuilderNet
The problem with the assembly line is where it narrows. Building the most profitable block is a capital-intensive, low-margin, winner-take-most business, and it has consolidated hard: the two largest builders routinely produce the large majority of Ethereum blocks, on the order of three-quarters or more, with a long tail of smaller builders fighting for the rest. That concentration is the single biggest worry in the MEV world, because a handful of builders that construct most blocks can also decide which transactions never make it in, whether for compliance reasons or their own advantage.
Vitalik Buterin made exactly this argument in March 2026, when he set out a plan to curb builder centralization and warned that enshrining PBS in the protocol would not be enough on its own; he called for complementary measures such as inclusion lists and encrypted mempools to stop a small group of builders from quietly controlling access to the chain (CoinDesk).
One market response is BuilderNet, launched by Flashbots alongside Beaverbuild and Nethermind. It runs block building inside trusted execution environments (secure hardware enclaves), shares the order flow it receives across a decentralized set of operators, and returns a portion of the MEV and fees to the wallets and users that sent the transactions (The Block). BuilderNet has grown to build roughly a quarter of Ethereum blocks, which makes it both a meaningful decentralizing force and, as some critics note, another large pool of flow that users must trust. The centralization question is not solved so much as reshaped.
Concentration also has a censorship dimension that is already live, not theoretical. After US sanctions hit the Tornado Cash mixer in 2022, a share of relays and builders began filtering transactions that touched sanctioned addresses in order to stay compliant, which meant some valid Ethereum transactions were quietly passed over. Inclusion lists exist precisely to blunt this: if the base layer can force a censored transaction back into a block, then no builder, however dominant, gets the final say over who is allowed to transact.
Defense Layer One: Going Private
If sandwich bots feed on the public mempool, the simplest defense is to keep your transaction out of it. Private transaction services, usually called private RPCs after the endpoint your wallet talks to, send your trade straight to builders or to a protected relay instead of broadcasting it for every searcher to see. No public preview means no sandwich, because the bot never learns your trade exists until it has already settled.
This has quietly become the default. Major wallets now route swaps through MEV-protected endpoints out of the box, which is part of why the question of who your wallet actually sends your order flow to has grown so important; we compared the leading options in MetaMask vs Phantom vs Rabby. The trade-off is trust and centralization: a private RPC sees your transaction before anyone else, and if a single provider handles most retail order flow, it becomes a powerful chokepoint of its own. Going private protects the individual trade while nudging the system toward exactly the concentration the ecosystem is trying to avoid.
Defense Layer Two: Order-Flow Auctions and Rebates
The next step up is to stop merely hiding order flow and start selling it back to the user. Order-flow auctions (OFAs) take your transaction, expose a safe, non-toxic version of it to a set of searchers, and auction off the right to backrun it. Because searchers can only trail your trade rather than wrap it, they cannot sandwich you; instead they bid for the harmless opportunity your trade creates, and most of that bid is refunded to you.
Flashbots opened this lane with MEV-Share in 2023, pitched as a way for users to reclaim value that would otherwise be extracted from them. The best-known consumer version is MEV Blocker, an OFA that strips sensitive details such as slippage from your swap and pays users back roughly 90% of the value their backrunning opportunity generates, delivered in the same block (MEV Blocker docs). The rebate model turns MEV from a pure tax into something closer to a refund, but it does not remove the middleman; it changes what the middleman is paid to do, and it leaves open the risk that the off-chain operators running these auctions become a new point of centralization in their own right.
Defense Layer Three: Batch Auctions and Intents
The most structural fix is to change the thing being ordered. Instead of signing a specific transaction along a specific path, a user signs an intent: a statement of the outcome they want (sell one asset for at least a set amount of another) and lets competing solvers find the best way to deliver it. CoW Swap pioneered this on Ethereum with batch auctions, which collect many orders and settle them together at a single uniform clearing price (CoW DAO).
Two properties make this powerful against MEV. First, there is no public pending transaction to sandwich; the order only touches the chain when a solver settles the whole batch. Second, a solver that tries to extract value from the trades it settles will lose to a solver that does not, because the auction rewards the best price for users. Sandwiching does not merely get harder; it becomes a losing strategy for the people competing to fill your order. Intents also pair naturally with the smart-account wallets spreading across the ecosystem, where a signed goal can be executed by a solver or paymaster on the user’s behalf, a shift we unpack in our look at smart-account wallets. The catch is that users now trust solvers to compete honestly, which is why solver decentralization is the live debate in intent-based trading.
The App-Owned Turn: Protocols Reclaiming Their Own MEV
The defenses above protect the user at the moment of the trade. The bigger shift in 2026 is happening one level up, as applications stop leaking MEV to outside searchers and start capturing it for their own users and liquidity providers. If ordering inside an app is valuable, the reasoning goes, the app itself should own that value rather than hand it to whoever wins the builder auction.
Application-specific ordering is the clearest expression of this. Angstrom, built by Sorella Labs as a Uniswap v4 hook, runs a per-pool sequencer that blocks sandwiching and auctions the right to arbitrage a pool, then redirects the auction proceeds to that pool’s liquidity providers instead of letting the value leak to outside searchers (Sei research). A related move is happening at the protocol-treasury level: Uniswap’s UNIfication upgrade, approved by governance in December 2025 with near-unanimous support, switched on protocol fees and routes them into a mechanism that burns UNI, with net sequencer fees from Uniswap’s own Unichain rollup feeding the same burn (CoinDesk). Several of these designs lean on secure hardware enclaves to prove that ordering was done honestly, importing the same trust-minimized computation ideas now common across the rest of crypto.
The economic target of much of this work is a cost that liquidity providers rarely see named: loss-versus-rebalancing, or LVR, the value LPs bleed to arbitrageurs every time the market moves and their pool is picked off at a stale price. Ordinary automated market makers leak that value to whoever wins the race to arbitrage them. Application-specific ordering tries to intercept it, auctioning the arbitrage right and paying the proceeds to the pool, so the people supplying the liquidity capture the value their capital creates instead of subsidizing outside bots.
The through-line is a change in default. For most of MEV’s history, value that originated inside an application flowed outward to searchers, builders, and validators. The app-owned turn tries to keep it inside, returning it to the liquidity providers and traders who generated it in the first place.
MEV Beyond Ethereum: Solana, Jito, and the L2 Frontier
MEV is not an Ethereum-only phenomenon; every chain with contested ordering has a version of it. Solana, trading near $100 in September 2026 (CoinGecko), has no global public mempool, which changes the game: rather than watch a shared queue, searchers submit bundles with tips through infrastructure built by Jito, whose client software is run by a large share of Solana validators. Those tips get recycled, because Jito’s liquid staking token, JitoSOL, passes a portion of MEV tips back to stakers, turning extraction into staking yield.
The opacity of Solana’s design also produced its own sandwich problem, and the Solana Foundation answered in a way Ethereum’s credibly-neutral culture rarely does: it removed dozens of validators from its delegation program for running private mempools that enabled sandwiching, with its validator-relations lead framing the action as a firm line rather than a warning (CryptoSlate). Layer 2 networks add another frontier. Because most rollups still run a single sequencer, that sequencer holds enormous ordering power, and several are experimenting with how to price or constrain it, from timed priority auctions to verifiable ordering inside secure enclaves. As trading spreads across dozens of rollups and app-chains, cross-domain MEV, coordinated across venues, is the fast-emerging hard problem.
Some rollups are trying to turn that ordering power into a transparent, priced good rather than a hidden one. Arbitrum’s Timeboost, for instance, auctions a short-lived express lane so that the advantage of going first is sold openly and the proceeds return to the ecosystem, rather than being captured quietly by the sequencer. Others are exploring shared sequencing, where many rollups outsource ordering to a common neutral layer; done well it could tame cross-domain extraction, and done badly it could recreate the same concentration problem one level higher up the stack.
The Protocol Endgame: ePBS, Encrypted Mempools, and Glamsterdam
Ethereum’s long-term answer is to bake fairer block production into the protocol itself. The headline change is enshrined proposer-builder separation (ePBS), specified as EIP-7732 and lined up as a headliner of the Glamsterdam upgrade, alongside EIP-7928 block-level access lists that make execution more efficient (Base). ePBS moves the builder auction from out-of-protocol software like MEV-Boost into Ethereum’s own consensus rules, which removes some of the trust currently placed in relays.
Enshrinement alone is not the whole fix, and the roadmap reflects that. Fork-choice inclusion lists (FOCIL, EIP-7805), a censorship-resistance tool that lets a committee force transactions into blocks even when a dominant builder would rather exclude them, was deliberately scoped out of Glamsterdam to keep that upgrade on schedule and is expected in a later fork. Beyond it, researchers are working on encrypted mempools, where transactions stay hidden until after they are ordered, which would kill front-running at the root by denying searchers the preview they depend on. That is the fuller version of the plan Buterin sketched in 2026: enshrine building, add inclusion lists, encrypt the mempool, and anonymize routing so that no single actor can see or steer the flow. As of late 2026, Glamsterdam is still in testing and its activation date has slipped more than once, a reminder that getting these mechanisms right outranks shipping them fast.
Is MEV Legal? The SEC and the Peraire-Bueno Test
MEV lives in a regulatory blind spot. In the United States, market conduct is split between the SEC, which oversees securities, and the CFTC, which oversees commodities and derivatives, and both frameworks were built for registered intermediaries: brokers, exchanges, and market makers with known identities and disclosure duties. An anonymous bot reordering trades on a permissionless DEX has no registration, no client relationship, and often no clear jurisdiction, so the usual conduct rules do not obviously reach it. That is the gap.
When prosecutors did move, they reached for general fraud law rather than securities rules. The case of brothers Anton and James Peraire-Bueno, the first US criminal prosecution built around MEV, accused the pair of exploiting a vulnerability in MEV-Boost to bait trading bots and drain roughly $25 million in a matter of seconds in 2023, and charged them with wire fraud and money laundering conspiracy. Their 2025 trial ended in a hung jury, prosecutors asked to try them again in early 2026, and as of this writing the case remains unresolved (Cointelegraph). Its central question, whether exploiting the public rules of an open system is fraud or simply hard-nosed trading, is the same one that hangs over sandwiching itself. Until a court or Congress answers it, the honest description is that most MEV is neither clearly legal nor clearly illegal; it is simply unregulated, and the market is writing its own rules through the defenses above faster than any agency is writing them.
The deeper tension is philosophical as much as legal. A long strand of crypto culture holds that code is law, that whatever the protocol permits is fair game, and by that logic a searcher who follows the public rules has done nothing wrong. Prosecutors and many users see it differently when a bot manufactures a worse price for a specific victim. The CFTC has signaled that manipulation on digital-asset markets falls within its remit, and the SEC continues to assert authority over tokens it deems securities, but neither has drawn a bright line around transaction ordering itself. For now, the rules that bite are the ones the market builds.
What This Means for Everyday Traders
For most users, the practical takeaways are short.
- Use a wallet or RPC that offers MEV protection by default, so ordinary swaps are not broadcast naked to the mempool.
- For larger trades, prefer venues built on batch auctions or intents, where sandwiching is structurally hard, and check whether the app returns MEV to its liquidity providers or leaks it to searchers.
- Watch your token approvals; the same open approvals that drained a famous bot can drain a careless user.
- Treat any promise of MEV-free trading with healthy skepticism, since protection usually means shifting trust to an RPC, a solver, or a builder rather than removing it.
The larger story is that MEV in 2026 is no longer only about extraction. The strategies that take value are as sharp as ever, but a parallel industry now exists to hide it, auction it back, or capture it for the people who created it. The extraction playbook and the reclaim playbook are being written at the same time, and which one wins on any given trade increasingly depends on choices that the user, and the app, get to make.
Frequently Asked Questions
What is MEV in crypto?
MEV, or maximal extractable value, is the profit that a block producer, and the searchers bidding for their attention, can earn by choosing which transactions go into a block and in what order. It shows up as arbitrage, liquidations, and sandwich attacks, and it exists on any blockchain with a public transaction queue and contested ordering.
Are sandwich attacks illegal?
In most jurisdictions there is no specific law against sandwiching. It exploits publicly visible pending transactions rather than any privileged information, so it does not fit neatly into insider-trading or fraud statutes. In the United States, neither the SEC nor the CFTC has a rule aimed at it, and the one major MEV criminal case, against the Peraire-Bueno brothers, targeted an exploit of MEV infrastructure rather than ordinary sandwiching.
How can I protect my trades from MEV?
Use a wallet or private RPC that offers MEV protection so your swap is not broadcast to the public mempool, and for larger orders use venues that rely on batch auctions or intents, such as CoW Swap, where sandwiching is structurally difficult. Order-flow auctions like MEV Blocker go a step further and refund most of the backrunning value your trade creates.
Do validators make money from MEV?
Yes. Through MEV-Boost, validators receive payments from builders in exchange for proposing the most valuable block, and those payments have become a meaningful part of staking returns. On Solana, Jito’s JitoSOL passes a share of MEV tips back to stakers in a similar way.
Will Ethereum upgrades end MEV?
No upgrade will eliminate MEV, because ordering will always have value. Changes such as enshrined proposer-builder separation (EIP-7732) and, later, censorship-resistance tools like FOCIL and encrypted mempools aim to make block production fairer and harder to censor or front-run, not to remove extractable value entirely.
By Yuki Tanaka, DeFi Correspondent at HOGE Wire.