MEV Strategies Explained: Crypto’s Invisible Tax in 2026

On April 30, 2026, the single most influential person in Ethereum made a trade worth about four dollars, and a bot skimmed it anyway. Vitalik Buterin swapped 26,544 units of an obscure token for roughly $4.56 in ETH. In the same block, an address the industry knows as jaredfromsubway.eth wrapped that trivial order inside a pincer, deploying around $1.14 million in wrapped ETH across Uniswap and SushiSwap pools to nudge the price against him and capture the spread, as CoinDesk reported. The bot may not even have turned a profit on that particular swap. That is precisely the point. The machinery is automatic, indiscriminate, and always watching.

This is maximal extractable value, or MEV, the hidden economy that runs underneath nearly every decentralized exchange trade, lending liquidation, and token launch. It is the profit a block producer or a trading bot can capture purely by choosing which transactions enter a block and in what order. By CoinDesk’s accounting, cumulative MEV extracted on Ethereum alone now exceeds $1.2 billion, and sandwich attacks like the one that caught Buterin account for roughly half of that volume. On a good day it keeps prices honest across venues. On a bad day it is a tax on everyone who clicks ‘swap’ without protection.

MEV is not a single trick. It is a family of strategies, a multi-layered supply chain of specialists, and, increasingly, a battleground for protocol designers and prosecutors. This guide walks through how the strategies actually work, who profits at each step, how the fight has spread from Ethereum to Solana and Layer 2 networks, and why the United States Department of Justice and the SEC are now circling an activity that did not exist a decade ago.

What Maximal Extractable Value Actually Means

MEV started life with a narrower name. When Cornell researcher Philip Daian and his co-authors published Flash Boys 2.0 in 2019, they called it ‘miner extractable value,’ the profit a miner could wring from a block by reordering, inserting, or censoring transactions. Their paper documented arbitrage bots fighting priority gas auctions, bidding transaction fees ever higher to win the right to front-run a trade, and it warned that this competition could destabilize consensus itself. After Ethereum switched to proof of stake, miners became validators, and the community relabeled the concept ‘maximal extractable value’ to preserve the acronym while acknowledging that miners are no longer the only ones extracting.

The canonical definition, from the Ethereum Foundation, is the maximum value that can be pulled from block production in excess of the standard block reward and gas fees by including, excluding, and changing the order of transactions in a block. The operative word is ordering. On a blockchain, the sequence of transactions is not neutral. Whoever decides that sequence holds a lever over prices, and any lever over prices is worth money.

Ethereum’s public mempool, the waiting room where pending transactions sit before they settle, is what turns that lever into a live auction. Because anyone can watch orders arrive, a profitable trade becomes visible to thousands of competing bots the instant it is broadcast. Visibility plus ordering power is the entire game.

The MEV Supply Chain: Who Extracts, Who Builds, Who Wins

Modern MEV is not one bot against one trader. It is an assembly line with four specialized roles, a structure that hardened after Ethereum adopted proposer-builder separation (PBS) through Flashbots’ MEV-Boost software. Splitting the job of producing a block into distinct functions was meant to stop MEV skill from becoming a reason to centralize the validator set.

Searchers run algorithms that scan the mempool and on-chain state for profitable opportunities, then package their moves into bundles. Builders collect those bundles alongside ordinary transactions and assemble the most valuable ordered block they can. Relays sit between builders and validators, holding a block’s contents secret until the validator has committed to it, so nobody can steal the winning strategy. Proposers, the validators selected to publish each block, simply pick the highest bid. The table below maps the flow.

The elegance of this design is that a solo staker with a home node can collect nearly the same MEV income as a professional pool, because both simply auction their block space to the same competitive builder market. The danger, as we will see, is that the builder and relay layers have concentrated into a handful of firms.

DEX Arbitrage: The Benign Engine

Not all MEV is predatory. The largest and least controversial category is decentralized exchange arbitrage. Automated market makers such as Uniswap price assets algorithmically inside isolated pools, so the same token can trade at slightly different prices on different venues at the same instant. A searcher who spots ETH trading cheaper on one pool than another can buy on the first and sell on the second inside a single atomic transaction, pocketing the gap. If any leg fails, the whole transaction reverts and nothing moves.

This is the healthy backbone of on-chain markets. Every time an arbitrageur closes a price gap, they drag the two pools back toward a shared, accurate price, which is exactly what keeps a stablecoin near its peg or a liquid-staking token near its fair value. Nobody is worse off; the profit comes from correcting a mispricing that the pools’ own math created. The competition to capture these edges is fierce, which is why searchers obsess over gas optimization and latency, but the externality on ordinary users is close to zero. When people defend MEV as a feature rather than a bug, arbitrage is the example they have in mind.

Arbitrage also has more aggressive cousins that blur the benign label. Just-in-time (JIT) liquidity is one: a fast bot detects a large incoming swap, deposits concentrated liquidity into the exact price range a fraction of a second before the trade lands, collects most of the fee, then withdraws immediately, capturing revenue that would otherwise have accrued to passive liquidity providers. Arbitrage between centralized venues and on-chain pools is another, and by value it is one of the largest categories of MEV, because the deepest price gaps still open between off-chain order books and AMM pools during fast moves. None of this harms a retail swapper directly, but it shows how quickly a healthy function shades into a professionalized, winner-take-most contest.

Liquidations: Racing to Clear Bad Debt

Lending protocols such as Aave and Compound let users borrow against collateral, and they stay solvent only if undercollateralized positions are closed quickly. When a borrower’s collateral value falls below the required threshold, the protocol invites anyone to repay part of the debt in exchange for the borrower’s collateral at a discount, the liquidation bonus. That bonus is a bounty, and MEV searchers running ‘keeper’ bots compete to claim it the moment a position crosses the line.

Like arbitrage, liquidation MEV is broadly useful. It transfers risk away from the protocol and its depositors and onto professional actors who are paid to absorb it, which is why credit markets on-chain can function without a central risk desk. The person who pays is the borrower who let their position deteriorate, and the fee they lose is disclosed in advance in the protocol’s rules. The competition, however, can turn ugly: during volatile crashes, dozens of bots bidding for the same liquidation can congest the network and spike gas fees for everyone else, an echo of the priority gas auctions Daian’s team first described.

The stakes become obvious during a sharp drawdown. When ETH or another major collateral asset drops several percent in minutes, thousands of loans can approach their liquidation threshold at once, and the keeper bots that clear them are effectively performing the risk management a traditional exchange would run in-house. That is genuinely valuable work, yet it concentrates power: the searchers who can simulate positions fastest and bid most aggressively for block space capture the lion’s share of liquidation bonuses, and in extreme volatility their gas bidding can price ordinary users off the network entirely. Efficient markets and congested markets are, in this corner of DeFi, the same phenomenon seen from two angles.

Sandwich Attacks: The Strategy Everyone Hates

If arbitrage is the acceptable face of MEV, the sandwich attack is its villain. It targets ordinary swappers directly. When you submit a trade to an AMM, you set a slippage tolerance, the maximum price movement you will accept. A sandwich bot spots your pending order, buys the same asset just ahead of you to push the price up, lets your trade execute at that inflated price, then sells immediately behind you. You get filled at the worst price your slippage allowed; the bot banks the difference. Two of the bot’s transactions bracket yours like slices of bread, hence the name.

The economics are brutal at scale. The jaredfromsubway.eth operation has run this playbook across hundreds of thousands of transactions since 2023; CoinDesk tallies its cumulative haul at more than $7 million, and other trackers have put it higher. Sandwiching is also why Buterin’s four-dollar swap mattered as a symbol: the co-founder who has spent months campaigning against toxic MEV, floating encrypted mempools and other defenses, was sandwiched by the ecosystem’s most notorious bot on a trade too small to matter. The table below sorts the major strategies by who ultimately pays.

Frontrunning, Backrunning, and the Dark Forest

Frontrunning and backrunning are the primitive moves underneath sandwiching. To frontrun is to see a profitable pending transaction and submit your own copy with higher priority so it lands first. To backrun is to place a transaction immediately after a known event, for example arbitraging a large swap right after it moves a pool; backrunning is often harmless and can even be socially useful, because it corrects prices without harming the original trader. The truly unnerving variant is the generalized frontrunner, a bot that does not need to understand a transaction at all. It simulates any pending transaction, and if the copy is profitable, it replaces the sender’s address with its own and races it to the chain.

This is the world Paradigm researchers Dan Robinson and Georgios Konstantopoulos captured in their 2020 essay Ethereum is a Dark Forest. Attempting to rescue roughly $12,000 in stranded Uniswap tokens, they watched their rescue transaction get front-run by predatory bots before it could confirm. Broadcasting a naked, profitable transaction to the public mempool, they argued, is like lighting a signal fire in a wilderness full of hunters: something finds you before you finish. That metaphor reframed MEV from an obscure trading niche into a fundamental property of transparent blockchains, and it still shapes how builders think about protecting users today.

How MEV-Boost Rewired Ethereum

The organization that did the most to drag this economy into the light is Flashbots. Its founding document framed the stakes bluntly, warning that unchecked MEV could grow to benefit a few at the expense of many, at the expense of the value of cryptocurrency itself. Its answer was a three-part mission it summarized as illuminate, democratize, distribute: make MEV measurable, give everyone equal access to the tools to capture it, and route the proceeds back toward users and network stability.

In practice that meant MEV-Boost, released after the 2022 Merge, which let validators outsource block construction to the open builder market described earlier. The overwhelming majority of Ethereum blocks are now assembled this way. For the people who stake ETH to secure the network, this quietly changed the economics of validating: MEV can add a meaningful premium on top of base issuance, and because MEV-Boost equalizes access, that premium flows to small validators nearly as efficiently as to large ones. It was, on its own terms, a success: the dark forest got a functioning marketplace, and solo stakers stopped being second-class citizens.

The mechanics are worth spelling out, because they explain why the relay layer became so powerful. A builder does not hand the validator a finished block up front. It sends only a signed header with a bid, and the validator signs that header to commit to it before ever seeing the transactions inside. Only then does the relay reveal the block body. This commit-then-reveal sequence is what stops a validator from copying a builder’s profitable ordering and cutting the builder out, but it also means the relay briefly holds a block the rest of the network cannot see, a position of trust that sits awkwardly with Ethereum’s permissionless ideals.

The Centralization Tax: Builders, Relays, and Censorship

The trouble is that MEV-Boost solved validator centralization by creating builder centralization. Assembling the most profitable block is a specialized, capital-intensive craft, and the market has consolidated around a small number of dominant builders and relays. That concentration matters for three reasons. First, a handful of builders now decide what a large share of Ethereum blocks contain. Second, because many relays chose to comply with United States sanctions after the Tornado Cash designations, censorship became a live concern: transactions touching a sanctioned address could be quietly excluded from compliant blocks. Third, and most alarming to protocol designers, is the time-bandit problem. If the MEV inside a past block ever dwarfs the reward for building the next one, a rational validator is tempted to reorganize the chain to steal it, threatening the finality users rely on.

None of these risks are hypothetical tail events. They are the everyday tension of an architecture that put enormous economic power into an intermediary layer that Ethereum never formally endorsed. Much of the roadmap discussed later exists to pull that power back inside the protocol, where its rules can be enforced by consensus rather than by the goodwill of a few companies.

MEV on Solana: Jito and the Sandwich War

MEV is not an Ethereum peculiarity; it appears anywhere ordering has value. Solana takes a different path because it has no global public mempool in the Ethereum sense. Instead, the dominant validator client from Jito Labs runs a block engine that auctions execution priority, and after Jito shut its public mempool in 2024 much of the activity moved into private channels. That opacity did not stop the abuse. It changed its shape.

The reason Solana produces a different flavor of MEV comes down to design. There is no persistent global mempool; instead a known leader schedule tells everyone which validator will produce blocks next, and traders send their transactions, along with priority fees and Jito tips, straight to that leader. That removes the public front-running surface Ethereum exposes, but it concentrates ordering power in whichever leader is up and rewards colocated infrastructure that can reach the leader first. Speed, rather than a visible mempool, becomes the edge, which is why the abuse migrated into the harder-to-detect multi-slot form instead of disappearing.

Solana sandwiching has evolved into a sophisticated ‘wide’ or multi-slot form, where the front-run and back-run transactions sit in different blocks so they are harder to detect. According to on-chain researchers at 0xGhostLogs, whose findings were reported by Cryptopolitan, wide sandwiches have accounted for the large majority of attacks, hundreds of thousands of victims have been affected, and the extracted totals run into the hundreds of thousands of SOL over the measurement window. In response, the Jito Blacklist Committee has repeatedly delisted validators caught enabling the practice, cutting them off from the staking rewards they depend on. It is enforcement by economic exile rather than by law, and it captures how young and improvised MEV governance still is on the fastest chains.

MEV on Layer 2s: Arbitrum’s Timeboost Experiment

Ethereum’s Layer 2 rollups face a distinct version of the problem. Most run a single sequencer that orders transactions, usually first come, first served. That sounds fair, but it silently rewards whoever can spam the sequencer with the lowest latency, turning ordering into a wasteful speed race. Arbitrum’s answer, Timeboost, went live in April 2025 and tries to price that advantage openly. Every minute, a sealed-bid, second-price auction sells a 60-second lease on an ‘express lane’ at the sequencer; the winner’s transactions are processed instantly while everyone else absorbs a fixed 200-millisecond delay. The revenue flows to the Arbitrum ecosystem rather than to latency arbitrageurs.

Turning a hidden latency race into a transparent auction is a genuine improvement, but it does not abolish MEV; it institutionalizes it. An empirical study of the mechanism, published on arXiv, found that express-lane control concentrated heavily, with a couple of entities winning the overwhelming majority of auctions, and that the design introduced its own spam dynamics. The lesson repeats across every venue: you can move MEV, redistribute it, or make it legible, but you cannot legislate it out of existence as long as ordering carries value.

Layer 2s also open a frontier that researchers call cross-domain MEV. As liquidity fragments across dozens of rollups and alternative chains, the most valuable opportunities increasingly span more than one domain at once: a price dislocation between an asset on Ethereum and the same asset on an L2, capturable only by an actor able to act on both sides before anyone else. Sophisticated players are already assembling the infrastructure to sequence these multi-chain plays, which threatens to recreate, at the interoperability layer, exactly the centralizing pressures that proposer-builder separation was designed to contain on a single chain.

Fighting Back: Private Order Flow and Intent-Based Trading

For ordinary users, the most effective defense is simple: stop broadcasting into the dark forest. Private RPC endpoints route your transaction to trusted builders instead of the public mempool, so sandwich bots never see it in time. Some, like CoW DAO’s MEV Blocker, go further, running a permissionless order-flow auction that lets searchers compete to backrun your trade and then rebates part of that value back to you. The same instinct drives intent-based trading. On CoW Swap, you do not sign a specific path through a pool; you sign an intent describing the outcome you want, and specialized solvers compete in batch auctions to deliver the best execution, with all trades in a batch clearing at a uniform price that removes the ordering edge a sandwich relies on.

This defensive layer is one reason smart-account wallets matter beyond convenience: programmable accounts can enforce slippage rules, default to protected RPCs, and express intents natively, so protection is the baseline rather than an expert setting. The table below compares the main options and their tradeoffs. None is free, and each shifts trust somewhere new.

Each of these defenses relocates trust rather than removing it. A private RPC shields you from the public mempool but asks you to trust that the operator and its builders will not exploit your order themselves, which is why the most credible services are moving toward hardware guarantees, running their order flow inside trusted execution environments so that even the operator cannot peek at what it forwards. Batch auctions shield you from ordering games but hand discretion to solvers, whose incentives have to be policed by competition and reputation. There is no setting that makes you both invisible and trustless; there is only a choice about which party you would rather depend on.

Enshrining the Fix: ePBS and Encrypted Mempools

The most consequential change on the horizon is an attempt to absorb MEV-Boost’s plumbing into Ethereum itself. EIP-7732, known as enshrined proposer-builder separation or ePBS, has been selected as the headline feature of Ethereum’s next major upgrade, Glamsterdam, with developers targeting activation later in 2026. By writing the proposer-builder split directly into the consensus rules, ePBS aims to remove the trusted relay from the critical path, reducing both the censorship chokepoint and the centralization pressure that the current off-chain market created.

ePBS is one prong of a longer campaign. Encrypted mempools, the approach Buterin has publicly favored, would keep transaction contents secret until their order is fixed, making sandwiching impossible because there is nothing to read. Inclusion-list and fork-choice-enforced inclusion proposals aim to guarantee that censored transactions still make it on-chain. Together these efforts represent a philosophical shift: rather than treating MEV as an externality to be mopped up by third parties, Ethereum is trying to make its own base layer MEV-aware. Whether the protocol can enshrine fairness without enshrining new bottlenecks is the open engineering question of the next two years, and it rhymes with older debates about how much block production should be left to competitive markets rather than dictated by protocol rules.

Is MEV Illegal? The SEC, the DOJ, and the Enforcement Gap

In traditional markets, trading ahead of a client order is a crime. Front-running by brokers and market manipulation are precisely the conduct the SEC and its rules exist to punish, and a sandwich attack looks, to a securities lawyer, uncomfortably like both. Yet applying those rules on-chain runs into hard questions. Is an anonymous sandwich bot a broker with duties to anyone? Is the token being swapped a security at all? Is a permissionless protocol a regulated venue? The uncomfortable core of the problem is that the identical power, deciding transaction order, produces price-correcting arbitrage in one case and predatory sandwiching in another, distinguished mainly by intent, which statutes struggle to codify.

American prosecutors have nonetheless taken a first swing. In May 2024 the Department of Justice charged brothers Anton and James Peraire-Bueno with wire fraud and money laundering over a scheme that exploited MEV-Boost to drain roughly $25 million from searcher bots in the span of a single 12-second slot, the first criminal case tied to MEV. Its outcome was a warning about how hard this terrain is: after a trial jurors found bewildering, the case ended in a mistrial in November 2025, with the jury deadlocked over how decades-old fraud law maps onto a blockchain. The episode underscores a wider enforcement gap that regulators worldwide are still trying to close, in which cross-border, pseudonymous, code-mediated value extraction slips between the categories that existing law was built for.

The ambiguity is not only American. Because searchers, builders, and validators can sit in different countries while the value moves on a single global ledger, no one regulator has clean jurisdiction, and the classification questions differ from place to place: what the SEC might treat as manipulation, the Commodity Futures Trading Commission might frame as a commodities market abuse, and European supervisors might approach through market-conduct rules written for exchanges that a sandwich bot does not resemble. The practical result is that most MEV, including the toxic kind, lives in a space where it is widely considered unfair yet almost never formally illegal, and closing that gap will take new law rather than new enforcement of old law.

What Traders and Builders Should Take Away

For everyday users, the practical checklist is short. Route swaps through a protected RPC or an MEV-aware venue rather than the raw public mempool. Keep slippage tolerances tight, because a generous slippage setting is an open invitation to a sandwich. Prefer intent-based exchanges for larger trades, where batch auctions blunt the ordering advantage. And treat every signature request with suspicion, since MEV losses and outright theft often begin with a careless approval; the discipline that protects you from signature-based phishing also narrows your MEV exposure. For anyone holding meaningful balances, pairing those habits with a hardware wallet keeps the final approval on a device an attacker cannot silently reach.

For builders, the mandate is to design as if MEV is a law of nature, because on a transparent ledger it is. That means auctioning ordering openly instead of letting it leak, returning captured value to users where possible, and minimizing the surface a protocol exposes to sandwiching. MEV will not disappear. The real contest, from Flashbots’ relays to Solana’s blacklist committee to Ethereum’s enshrined roadmap, is over who captures it, whether that capture is transparent, and how much of it flows back to the people whose trades created the value in the first place.

Frequently Asked Questions

What is MEV in crypto?

MEV, or maximal extractable value, is the profit that a block producer or trading bot can capture by controlling which transactions are included in a block and in what order. It covers healthy activity like arbitrage and lending liquidations, which keep on-chain prices accurate, as well as predatory activity like sandwich attacks that worsen the price ordinary traders receive. The term began as ‘miner extractable value’ in the 2019 Flash Boys 2.0 paper and was renamed after Ethereum moved to proof of stake.

Are MEV sandwich attacks illegal?

There is no clear answer yet. In regulated markets, front-running client orders is illegal and falls under SEC market-manipulation rules, and sandwich attacks resemble that conduct. But applying those rules to anonymous bots trading permissionless tokens is legally untested. The United States Department of Justice brought its first MEV-related criminal case against the Peraire-Bueno brothers in 2024, and it ended in a mistrial in November 2025 when jurors could not agree on how existing fraud law applies to blockchains.

How can I protect my trades from MEV bots?

Use a private RPC endpoint such as MEV Blocker so your transaction never hits the public mempool, set a tight slippage tolerance so an attacker has little room to move the price, and consider intent-based exchanges like CoW Swap, whose batch auctions clear trades at a uniform price and neutralize the ordering advantage sandwiching depends on. Smart-account wallets can make these protections the default rather than something you configure manually.

What is the difference between good and bad MEV?

Good MEV corrects inefficiencies without harming a specific user. Arbitrage that aligns prices across exchanges and liquidations that keep lending protocols solvent are examples; the value comes from fixing a mispricing or a bad debt. Bad, or toxic, MEV extracts value directly from another user’s transaction. Frontrunning and sandwich attacks are the main examples, because the bot’s profit is exactly the extra cost the victim pays.

How much MEV has been extracted on Ethereum?

Cumulative MEV extracted on Ethereum now exceeds $1.2 billion by CoinDesk’s accounting, with sandwich attacks responsible for roughly half of that volume. Measuring MEV precisely is difficult because much of it now flows through private channels rather than the public mempool, so most figures are conservative estimates rather than exact totals.

By the HOGE Wire markets desk, covering DeFi infrastructure and on-chain market structure.