REPORTED: All figures are estimates from an on-chain investigation by blockchain data firm Bitquery. This is research into trading bots, not a hack.
Automated “sandwich” bots on Solana carried out 6,850,144 attacks between 30 October 2025 and 7 October 2026, according to Bitquery [1]. It says 2,545 bot wallets caught 2,154,994 different wallets this way and took 309,010 SOL, worth $29.7 million, before costs [1].
Bitquery says 96% of the sandwiches hit memecoins on Pump.fun, the site where most new Solana memecoins launch, or on PumpSwap, Pump.fun’s own exchange [1]. Bitquery says its figures were checked on chain on 11 October 2026. CryptoSlate also reported the findings [2].
What is a sandwich attack?
When you swap one token for another on a decentralised exchange, your trade is public for a moment before it is final. A sandwich bot spots it and places two trades of its own around yours:
- Before you: the bot buys the same token, pushing the price up.
- Your trade: you buy at that higher price.
- After you: the bot sells into the price your purchase pushed up, and keeps the difference.
Nobody breaks into anything. The bot uses the rules of the exchange. This kind of profit, made by choosing the order of trades, is called MEV (“maximal extractable value”). But the money it makes comes from the person in the middle getting a worse price.
What is slippage?
Slippage is how much worse than the quoted price you will accept before your trade is cancelled. Set it at 1% and your swap fails if the price moves more than 1% against you. Set it at 30% and you are telling the network you will accept a price up to 30% worse.
That gap is the bot’s room. The wider your setting, the more the bot can push the price up and still let your trade go through.
What Bitquery found
- Scale: about 3,400 sandwiches a day in November and December 2025, rising to 51,900 a day in September 2026, which Bitquery calls 15 times as many [1].
- Where: 62% on PumpSwap and 34% on Pump.fun’s launch curve, the pricing formula a new coin trades on at first [1]. Bitquery says memecoins suit the bots because their pools are small, so one buy moves the price a lot, and buyers tend to allow wide slippage.
- Bots eating bots: 39% of the take came from trades by other bots, such as “snipers” that buy new coins in their first seconds [1].
- Small bites: the median sandwich made the bot $2.33 [1].
- Spread out: the ten wallets that took the most made 13% of the total [1].
- Costs: in a sample of 63 attacks, after fees and tips the bots kept 68% of the gross, and 18 of the 63 lost money [1]. So the $29.7 million is not profit.
Slippage settings matter
Jupiter, a swap router many Solana apps use, records each swap’s slippage limit. Bitquery compared Jupiter swaps into Pump.fun coins: those allowing 20% to 50% slippage were caught in a sandwich 14 times as often as those allowing under 3% [1].
How to protect yourself
This is general information, not financial advice.
- Keep slippage low. A few per cent is usually enough for well-traded tokens. Be wary of apps that default to very high settings.
- Be careful with brand-new memecoins. Small pools move fast, which is why people raise slippage and why bots gather there.
- Split large trades. A smaller trade moves the price less, leaving less for a bot to take.
- Check your wallet or swap app’s settings for any built-in MEV or sandwich protection.
What this is not
Pump.fun was not hacked, and Bitquery does not say Pump.fun took users’ money. The bots are separate traders using public exchange rules. The figures come from Bitquery’s own methods and have not been independently checked by TSN.
Sources
- Bitquery, “Solana sandwich attacks” investigation, on-chain figures verified 11 October 2026. https://bitquery.io/investigations/solana-sandwich-attacks
- CryptoSlate, “Solana sandwich bots took $29.7 million before costs, Bitquery estimates”, 12 October 2026. https://cryptoslate.com/solana-sandwich-bots-took-29-7-million-before-costs-bitquery-estimates/
