Infamous Solana bot ‘arsc’ has made over $30 million over the span of two months via MEV attacks.

In a sandwich attack, malicious actors look for pending transactions on blockchain networks. They end up placing two transactions around: one before and another after, triggering a sandwich.

The actors buy the underlying asset, which ends up pushing up the price. Right after, they sell it at a higher price, gaining from the manipulated price difference.

MRGN Research’s founder, Ben Coverston, pointed out that most of the profits currently lie in two wallets. The first ‘almost inactive’ one holds about $20 million. According to Coverston, this is almost a locked-down cold wallet.

According to SolanaFM, the value of the funds locked here are now worth around $18.5 million, with more than $16.5 million diverted towards SOL. The other four assets held in the wallet include Kabosu, CringeCoin, Wrapped Solana, and USDC.

Unlike the former inactive one, the second wallet is quite active within the Solana DeFi ecosystem. Coverston pointed out that it is gradually converting SOL into USDC via JUP DCA. Parallelly, it also holds “significant positions” in Kamino and various LSTs.

The MRGN Research executive identified another parallel address and labeled that to be the main "SOL bank" for sandwiches. Notably, it uses dozens of signers and tippers while sandwich attacking. Coverston added,

“It seems they don't enjoy the attention, as they've recently gone to great lengths to hide their activities and profits.”

In another recent development, a few validators were removed from Solana's delegation program on the heels of their involvement in sandwich attacks on Solana users. Sandwich attacks are against the Solana Foundation’s rules.