DOJ charges 2 people over $25 million ETH theft via MEV exploit

The DOJ arrested and charged two individuals on May 15 over an alleged $25 million MEV exploit that occurred on the Ethereum blockchain.

The defendants — brothers Anton and James Pepaire-Bueno — face three charges of conspiracy, wire fraud, and money laundering, each with a potential 20-year sentence.

Line of attack

The defendants‘ plan involved several steps focused on Ethereum’s maximal extractable value (MEV) — particularly the MEV-Boost software many Ethereum validators use to optimize transactions as searchers seek profitable arbitration opportunities using MEV bots.

First, the defendants allegedly established Ethereum validators and concealed their identities through various tactics. After establishing the network, the defendants supposedly created a series of “bait” or test transactions to study MEV bots trading activities.

Then, after months of planning, the defendants lured victim traders into performing front-run trades, enticing the victims to purchase illiquid cryptocurrencies that were expected to gain value as a result of the transaction.

Later, during transaction ordering, the defendants exploited a vulnerability to replace the lured transactions with tampered transactions, thereby blocking the victims final sale. The defendants kept the stablecoins and highly liquid cryptocurrencies that the victims originally spent, thereby finalizing the theft.

The defendants then allegedly laundered the funds through various methods.

Mixed response

The case is notable as it concerns a new type of crypto crime.

US Attorney of the Southern District of New York Damian Williams said the scheme “has never been charged before” and said it “exploit[ed] the very integrity of the Ethereum blockchain.”

The case has attracted backlash from individuals who consider highly profitable uses of MEV bots, such as the trades that the defendants allegedly blocked, to be an issue in their own right.

AllianceDAO Contributor and VoltCapital Venture Partner Mohamed Fouda said:

“When an MEV bot uses $25 [million] of stablecoins to sandwich 8 different transactions of illiquid coins, that is a [completely] honest business. …If you bait this MEV bot, then thats a crime.”

Fouda also asserted that the case improperly portrays the duties of Ethereum relayers. He called it a “trap to pull every operator on Ethereum into a web of legal compliance requirements.”

Ryan Sean Adams of Bankless likewise dismissed the distinction between transactions, rhetorically asking:

“What‘s legal MEV, and what’s illegal MEV that gets you 20 years in jail？”

Other commentators opposed the alleged theft. Head of Commercial at Brainbot Loring Harkness said:

“Stealing from thieves is still theft.”

CEHV partner Adam Cochran called the case a “much more clear case of exploit” than widely reported.

Metamask Lead Product Manager/Owner Taylor Monahan said:

“Yes, if you steal and launder $25 million dollars you should expect to go to prison for a long time … ”

The DOJ has yet to prove its case in court.