Sandwich bots managed to siphon off approximately $29.7 million from Solana trades over an 11-month period, as per data from blockchain analytics firm Bitquery. The majority of these attacks, amounting to 96%, were targeted at memecoin platform Pump.fun’s launch curve and PumpSwap exchange.
Bitquery’s investigation revealed a total of 6,850,144 attacks carried out by 2,545 bot wallets, impacting 2,154,994 distinct wallets between October 30, 2025, and October 7, 2026. It’s important to note that these wallet addresses do not equate to individual users, as a significant portion of the profits generated came from trades executed by other bots.
The modus operandi of these sandwich attacks involves a bot strategically placing buy and sell orders around a trader’s transaction. This results in artificially inflating the pool price, leading to the intervening trader receiving fewer tokens while the bot capitalizes on selling at the inflated price. The cost of this manipulation is borne by the trader, even if the swap is successfully completed.
One interesting observation made by Bitquery was that trades allowing for 20%–50% slippage were targeted significantly more than those with under 3% slippage. Slippage tolerance refers to the deviation allowed in execution from the quoted price. A wider slippage limit increases the risk of receiving a less favorable fill in exchange for completing a volatile trade.
The estimated $29.7 million figure represents the value of SOL at the moment of each attack and does not reflect the net profit gained by the bots. In a sample of 63 attacks analyzed by Bitquery, bots retained 68% of the total gross proceeds, with 18 attacks actually resulting in losses after factoring in costs. It should be noted that this sample does not provide a definitive measure of the bots’ net earnings over the entire period.
Bitquery’s methodology involved identifying bots through repeated trading patterns, excluding round trips within a token’s initial 10 slots, and acknowledging limitations in exchange and block coverage. While chain records cannot definitively prove whether a bot had prior knowledge of an order, this analysis sheds light on the prevalence of automated trading strategies in the cryptocurrency space.
Furthermore, a separate research preprint submitted on September 23, 2026 delved into the concept of protected order flow across various blockchains, highlighting the prevalence of sandwich trading patterns and the potential discrepancies in the safeguards provided to users.
Overall, the investigation into Solana sandwich attacks underscores the challenges posed by automated trading bots and the importance of implementing robust risk management strategies in decentralized finance ecosystems.
