What Is MEV in Crypto? How Frontrunning and Sandwich Attacks Work

You did nothing wrong. You picked a reasonable token and clicked swap. Somewhere between you clicking and the blockchain confirming your trade, an automated bot noticed your transaction and jumped in. All it did was alter the price and walk away with a cut of your money. And you never saw it happen.

That’s MEV. And it has been quietly taxing DeFi traders for years.

This guide breaks down exactly what MEV crypto is, how frontrunning and sandwich attacks work in practice, and what you can actually do to reduce your exposure.

Key Takeaways

• MEV (Maximal Extractable Value) is profit extracted by block builders and bots through manipulating transaction order on-chain.
• Frontrunning crypto attacks copy your pending transaction and pay more gas to get in front of you.
• A sandwich attack places one trade before and one after yours to profit from the price swing your trade causes.
• Low-liquidity tokens and high-slippage settings are the biggest risk factors for retail traders.
• MEV protection tools like private RPCs, Flashbots Protect, and MEV Blocker exist and are worth using.
• Sandwich attacks resulted in approximately $289.76 million, or 51.56% of the total MEV volume of $561.92 million tracked in the data.

What Is MEV in Crypto and How Does It Work?

MEV, or Maximal Extractable Value, is the extra profit that validators and bots can extract by controlling the order of transactions inside a block. 

Every time you submit a swap on a DEX, your transaction sits in a public waiting room called the mempool before it gets confirmed. Anyone can see it. And that’s the exposure.

But in practice, most MEV isn’t collected by validators directly. In fact, it gets harvested by automated crypto bots called searchers that scan the mempool constantly. These bots submit competing transactions with higher gas fees to jump the queue. Validators get a cut through those elevated fees.

Why transaction order matters on blockchain

Think of the mempool like a restaurant ticket queue. The kitchen staff is the validator who decides which order ticket to cook. If someone can bribe the kitchen to cook their order first, they can profit from knowing what everyone else ordered.

Say you send a transaction to buy 1 ETH worth of a token on Uniswap. That transaction is visible to every node on the network before it confirms. An MEV bot reads your slippage tolerance and figures out the price range you will accept. That information is enough to build a profitable attack around your trade.

How MEV bots scan the mempool

MEV bots run continuously, checking every unconfirmed transaction for opportunity:

1. The bots monitor the mempool for large pending swaps, liquidations, or arbitrage gaps.
2. Simulate the transaction locally to calculate the expected price impact.
3. Build a competing transaction to front-run or sandwich the target.
4. Submit with a higher gas price to land earlier in the same block.
5. Collect profit from the price difference created.

For DEX arbitrage, some searchers competing for popular routes pay up to 90% of their potential profit in gas fees just to guarantee first position. That is how competitive this space is.

How Frontrunning Crypto Attacks Work

For a frontrunning attack in crypto to work, it requires insider access. And on a public blockchain, anyone with a bot and some gas can do it. The mempool makes every pending transaction visible by default.

When an MEV bot spots a large buy order about to move the market, it copies that intent, submits an identical (or similar) trade with a higher gas fee, and gets it confirmed first. By the time your original transaction executes, the price has already moved against you.

Step-by-step example of a frontrunning attack

Here is a concrete scenario. You want to buy a small-cap token on Uniswap. Your $5,000 buy is large enough to move the price roughly 3%.

• Your transaction lands in the mempool. Slippage tolerance: 5%. Current price: $1.00 per token.
• An MEV bot reads your transaction and calculates that your buy will push the price to roughly $1.03.
• The bot submits a buy for the same token with a higher gas fee, confirmed in the same block, but before your trade.
• Your transaction executes at the elevated price of $1.033. You received fewer tokens than expected.
• The bot immediately sells at the inflated price, pocketing the spread.

The bot didn’t hack anything. It read your publicly broadcast intent and acted faster. That is frontrunning crypto.

Why retail traders are the most vulnerable

Retail traders get hit hardest for a few reasons:

• Low awareness: Most people trading on DEXs do not know their transactions are visible in the mempool before confirmation.
• High default slippage: Wallets often default to 1-3% or higher, giving bots a wider profit window to exploit.
• Volatile periods: During sudden market spikes or token launches, mempool congestion rises, and bot activity rises significantly.

What Is a Sandwich Attack?

A sandwich attack is a specific type of MEV exploit where a bot places one transaction immediately before your trade and one immediately after, trapping your transaction in the middle. The attack profits from the price movement your trade creates.

Sandwich attacks are among the most damaging forms of MEV for regular traders because they are automated, fast, and often hard to detect after the fact. Sandwich attacks accounted for about $289.76 million of the $561.922 million in total MEV volume tracked in available data.

How sandwich attacks manipulate prices

Step 1: The bot buys before the victim

The bot detects your pending buy in the mempool. It submits a buy transaction for the same token with a higher gas fee. This front-run trade gets confirmed first, pushing the token price higher before your transaction even runs.

Step 2: Victim trade pushes price higher

Your transaction goes through, but at the already-elevated price. Because you set a 3-5% slippage tolerance, the trade still executes. You buy fewer tokens because the bot has acted. Your own trade pushes the price higher on top of what the bot already created.

Step 3: The bot sells immediately for profit

Then the bot reverses the transaction and closes the position by selling all the tokens it bought. It sells at the price you just helped push up. The spread between the bot’s buy price and sell price is the profit, minus the gas.

For example, in March 2025, a trader tried to swap $220,764 of USDC on Uniswap v3. An MEV bot front-ran the transaction and left the trader with only $5,271. A loss of nearly 98% in eight seconds.

Why Low-Liquidity Tokens Face More MEV Exploitation

Low-liquidity pools give bots more leverage per dollar traded. A $1,000 buy in a $50,000 pool moves the price significantly. The same buy in a $50 million pool barely registers. Small pools mean bigger swings per trade, and bigger swings mean more sandwich profit.

How MEV Bots and Gas Wars Affect Crypto Traders

When multiple MEV bots spot the same opportunity, they compete with each other. Each one submits a higher gas fee than the last. This is what crypto traders call gas wars.

Gas wars have two direct costs for ordinary users. First, they drive up network gas prices for everyone, even traders who are not being targeted. Second, the gas bots pay flows to block builders, not back to users who got outbid.

Are MEV Attacks Illegal in Crypto?

No, not in any jurisdiction with clear enforcement.

The longer answer is more complicated. MEV sits in a gray zone that varies by context.

In traditional finance, front-running by a broker who sees client orders before acting is illegal in most countries. On a public blockchain, the “broker” is a bot reading public data, and no law currently covers that activity in crypto.

Some researchers frame harmful MEV as a structural tax on retail traders. Others view it as rational market behavior that any participant could theoretically run. It’s an ongoing debate.

How Traders Can Protect Themselves From MEV

MEV protection isn’t perfect, but it is much better than doing nothing. Here are the practical options.

Use lower slippage settings

High slippage tolerance is basically an invitation. If you set 5% slippage, you are telling the network you will accept a price up to 5% worse than expected. Bots calculate the maximum they can extract within that window.

• For stablecoin swaps, use 0.1% or less.
• For ETH and major tokens with deep liquidity, 0.5% is usually sufficient.
• For volatile or illiquid tokens, accept that the trade might not go through rather than setting 3-5% slippage.

If a trade keeps failing at low slippage, that is often a signal that the pool is thin and more susceptible to MEV. Proceed carefully or choose a different route.

Avoid trading during extreme volatility

Mempool activity spikes during market volatility, token launches, and major events. That’s when gas wars and bot activity are the highest. So, waiting even for 30-60 minutes after a major market move can significantly reduce your exposure.

Use private RPCs or MEV protection tools

This is the highest-impact step most retail traders skip. Several tools exist to route your transactions away from the public mempool:

• Flashbots Protect RPC routes your transaction directly to block builders without broadcasting it publicly.
• MEV Blocker (by CoW Protocol and Gnosis) sends your trades to a private network of searchers who compete to give you the best price rather than extract from you.
• CoW Swap uses batch auctions that settle trades off-chain before posting them on-chain, largely eliminating sandwich attack exposure.

Private routing does reduce risk, but it’s not a complete solution. Research has found that even private routing channels saw 2,932 sandwich attacks affecting over 3,100 private transactions, producing $409,236 in losses.

Break large trades into smaller orders

A $100,000 swap in a thin pool is an ideal target. But a ten $10,000 swaps spread out across different routes is harder to profitably sandwich. 

Choose high-liquidity trading pairs

Deep liquidity means your trade moves the price less, which makes sandwich attacks less profitable. Bots calculate expected profit before attacking. If the expected profit from sandwiching your trade is below their gas cost, they ignore it.

• Stick to ETH, WBTC, and major stablecoin pairs when possible.
• Be especially careful with new token launches, low-cap meme coins, or any pool with under $500K in total liquidity.

How Ethereum and DeFi Platforms Are Reducing MEV

MEV will not disappear while blockchains remain transparent. But the ecosystem has developed meaningful tools to reduce its worst effects.

Flashbots and MEV auctions

Flashbots created a private channel called MEV-Boost where searchers submit transaction bundles directly to block builders instead of broadcasting them to the public mempool. This reduces gas wars and gives users who opt into Flashbots Protect some defense against frontrunning. 

Proposer-builder separation (PBS)

PBS separates the roles of proposing blocks and building their contents. Under the old system, the same party chose which transactions to include and decided their order. PBS split those jobs, added accountability and competition to how blocks get assembled, and reduced the unfair edge any single player had in extracting MEV.

MEV-resistant DEX designs

Several protocols are building MEV resistance into their architecture. CoW Protocol uses batch auctions matched off-chain, preventing sandwich attacks that require individually ordered transactions. Uniswap v4 hooks let pools implement custom MEV protection logic. dYdX and similar perp DEXs use off-chain order books invisible to the public mempool, removing the attack surface entirely.

Why MEV Matters for the Future of Crypto Trading

MEV is not just a technical footnote. It is a trust problem at the infrastructure level.

When a retail trader uses Uniswap for the first time and gets worse execution than expected, they rarely know why. What actually happened may have been a sandwich attack they never consented to and cannot contest.

Research covering 95,000+ sandwich attacks from November 2024 to October 2025 found that sandwich attacks still cost traders around $60 million per year. That too, after the attack frequency dropped while DEX volumes rose. 

Final Thoughts on MEV and Crypto Trading

MEV sounds abstract until it happens to you. The moment a sandwich attack turns a clean swap into a near-wipeout, it becomes concrete.

So, lower your slippage tolerance, route through MEV protection tools for anything significant, and avoid thin liquidity pools. And always remember that your pending transactions are public by default. MEV bots aren’t going away. But knowing what you are up against is the first step to trading smarter in DeFi.

FAQs