Solana sandwich bots extracted $29.7M in 11 months, mostly on Pump.fun

Sandwich bots extracted roughly $29.7 million before costs from Solana trades across an 11-month window, according to blockchain data provider Bitquery. The firm attributed 96% of the attacks it detected to memecoin platform Pump.fun's launch curve and its PumpSwap exchange. The estimate values SOL at the minute of each attack and is not a measure of net profit.

Bitquery counted 6,850,144 successful attacks carried out by 2,545 bot wallets, affecting 2,154,994 distinct wallets between October 30, 2025 and October 7, 2026. Those wallet addresses are not a count of individual people, and trades placed by other bots accounted for 39% of the estimated gross take. A sandwich works by placing a bot's buy and sell on either side of another trader's swap: the first purchase lifts the pool price, the intervening buyer receives fewer tokens, and the bot sells into the higher price. The cost is paid through execution even when the victim's swap succeeds.

Slippage settings shaped how often traders were targeted. Among swaps routed by Jupiter through Pump.fun's launch curve or PumpSwap, trades permitting 20% to 50% slippage were sandwiched 14 times as often as those allowing under 3%, per Bitquery. The pattern was not uniform: trades below 0.5% tolerance were hit more frequently than those set at 1% to 3%, while the 50%-or-more band was hit less often than the 20%-50% band. Bitquery noted Jupiter carried only a small share of all victim trades in the study, and the slippage comparison is observational.

The headline number is a gross figure, and Bitquery's separate sample of 63 attacks suggests costs matter. In that sample, bots retained 68% of aggregate gross proceeds, and 18 of the attacks lost money after costs, though Bitquery says the sample does not establish net earnings for the full period. The report also flagged inconsistent recording of Pump.fun sale fees, which it says affects the gross estimate by about 3%.

Bitquery identified bots through repeated trading patterns, excluded round trips that began in a token's first 10 slots, and reported gaps in exchange and block coverage. Chain records cannot prove a bot saw an order in advance, the firm acknowledged, and some qualifying wallets may simply be fast traders. Separately, a research preprint submitted September 23, 2026 examined protected order flow across six blockchains and found sandwich patterns spanning trades and blocks, concluding such protections can offer weaker guarantees than users expect.