Sandwich bots extracted approximately $29.7 million in gross proceeds from Solana trades over 11 months, according to an analysis by blockchain data provider Bitquery. The study identified 6,850,144 attacks by 2,545 bot wallets affecting 2,154,994 distinct wallets between October 30, 2025, and October 7, 2026.
Pump.fun's launch curve and its PumpSwap exchange accounted for 96% of detected attacks in the investigation. Other bots' trades contributed 39% of the estimated gross proceeds.
How Sandwich Attacks Work
A sandwich attack occurs when a bot places a purchase and sale around another trader's swap. The bot's initial purchase raises the pool price, causing the intervening buyer to receive fewer tokens. The bot then sells into the higher price, capturing the difference. The cost is borne by the trader even when the swap completes successfully.
Slippage Tolerance and Attack Frequency
Among trades routed through Jupiter to Pump.fun's launch curve or PumpSwap, trades allowing 20% to 50% slippage were sandwiched 14 times as often as those allowing under 3% slippage. Slippage tolerance sets the maximum acceptable deviation from a quoted price; wider tolerances permit worse execution prices but increase the likelihood of trade completion in volatile markets.
Trades below 0.5% tolerance were hit more often than those at 1% to 3% slippage, though the pattern did not rise uniformly across all settings.
Study Limitations
The $29.7 million figure represents gross extraction valued at the time of each attack and does not measure net profit. In a separate 63-attack fee sample, bots retained 68% of aggregate gross proceeds, with 18 attacks losing money after costs. The full-period net earnings cannot be established from this sample alone.
Bitquery identified bots through repeated trading patterns and excluded round trips beginning within a token's first 10 slots. The analysis notes gaps in exchange and block coverage, and chain records cannot definitively prove a bot accessed an order beforehand. Some qualifying wallets may represent fast traders rather than coordinated bot activity.
