Forward the Original Title ‘花 12 秒就窃走 2,500 万美元加密货币！美国「兄弟档骇客」遭逮捕审判’

U.S. prosecutors recently charged two brothers for allegedly using an Ethereum MEV attack to steal $25 million worth of cryptocurrency in about 12 seconds. The brothers were arrested earlier this week.

According to the indictment, the brothers carried out a well-planned “on-chain robbery operation” in April 2023, and their target traders were searchers operating MEV trading robots. These robots are mainly used for cryptocurrency arbitrage trading.

Prosecutors said they exploited a bug in the MEV-boost code that allowed them to preview the contents of blocks before they were officially delivered to validators, tampering with transactions and then stealing victims’ cryptocurrency. Additionally, the brothers refused to return the funds after committing the heist and hid the stolen cryptocurrency before laundering it.

In a serious breach of the Ethereum blockchain, two brothers, Anton and James Pepaire-Bueno, have been accused of carrying out a complex theft involving $25 million. The incident occurred in just 12 seconds. This reveals the controversial practice of the Maximum Extractable Value (MEV) mechanism, exposing a major vulnerability within the Ethereum system.

MEV-Boost & its Significance

MEV-Boost is a protocol designed by Flashbots and the community to mitigate the negative impact of Maximum Extractable Value (MEV) on the Ethereum network.

There are 3 participants in MEV-Boost:

1. Relay - a mutually trusted auctioneer that connects block producers and block builders

2. Builder - a complex entity that builds blocks to maximize its own MEV and that of the block producer

3. Block Producer—Ethereum’s Proof-of-Stake Validator

The approximate sequence of events for each block is:

1. A builder creates a block by receiving transactions from users, searchers, or other (private or public) order flows.

2. The builder submits the block to the relay.

3. The relay verifies the validity of the block and calculates the amount it pays to the block producer.

4. The relay sends a blank header and payment value to the block producer of the current slot.

5. Block producers evaluate all bids they receive and sign the blank header associated with the highest payout.

6. The block producer sends this signed header back to the relay.

7. Relays publish blocks using their native beacon nodes and return them to who generates the block. Rewards are distributed to builders and proposers through transactions within the block and block rewards.

The Relay is a trusted third party that facilitates fair exchange of block space among block producers and ordering of transactions by builders for MEV extraction. Relays protect builders by protecting them from MEV theft, preventing block producers from copying builders’ transactions to take away MEV without distributing it to the searchers/builders who discovered it. Relays protect block producers by confirming the validity of their blocks, processing hundreds of blocks per slot on their behalf, and ensuring the accuracy of block producers’ payments.

MEV-Boost is a critical protocol infrastructure because it enables all block producers to democratically access MEV without the need to establish a trust relationship with builders or searchers, which contributes to the long-term decentralization of Ethereum.

How MEV vulnerabilities work

MEV involves validators on Ethereum (and other blockchains) leveraging their ability to preview and manipulate transaction orders. The Pepaire-Bueno brothers allegedly took advantage of this by using MEV-boost, a software common among Ethereum validators. The software allows them to view and rearrange transactions in a block before final verification, allowing them to manipulate the outcome in their favor.

Detailed analysis of Ethereum attacks

The attack was carefully planned; the brothers set up 16 validators and used MEV bots to target specific traders. They designed decoy transactions to lure these bots to blocks controlled by one of their validators. By manipulating this block, they tricked the bot into executing trades that were detrimental to the trader but profitable for the brothers. They effectively replaced legitimate transactions with fraudulent transactions, removing large amounts of more liquid cryptocurrencies, such as stablecoins, under deceptive guise.

Impact on Ethereum Transactions

The transactions manipulated by the Pepaire-Bueno brothers turned large amounts of liquid assets into illiquid assets, rendering the cryptocurrency worthless to the victims. Not only does this call into question the integrity of Ethereum, but it also highlights the larger risks posed by MEV practices, where transaction sequence can be exploited for huge financial gain.

Legal and regulatory implications

The milestone case heightened concerns about the security and fairness of blockchain technology. The U.S. Department of Justice has charged the brothers with wire fraud and money laundering. The indictment highlights the legal challenges in the blockchain space. Additionally, it recommends possible regulatory actions to strengthen blockchain security measures. Furthermore, the case serves as a reminder to the cryptocurrency world that stronger safeguards are urgently needed. These safeguards will prevent transaction data from being manipulated.

The incident, which integrates technology, deception and high-stakes trading, marked a critical moment in protecting digital assets. Furthermore, it highlights the importance of maintaining trust in the blockchain ecosystem. Therefore, the Ethereum community and the broader cryptocurrency market must urgently develop stronger security protocols. Finally, they need to implement these protocols to prevent similar attacks in the future.

Disclaimer：

1. This article is reprinted from [区块小杜]. All copyrights belong to the original author [区块小杜]. If there are objections to this reprint, please contact the Gate Learn team, and they will handle it promptly.
2. Liability Disclaimer: The views and opinions expressed in this article are solely those of the author and do not constitute any investment advice.
3. Translations of the article into other languages are done by the Gate Learn team. Unless mentioned, copying, distributing, or plagiarizing the translated articles is prohibited.