Solana sandwich bots took $29.7 million before costs, mostly targeting Pump.fun

Between October 30, 2025, and October 7, 2026, sandwich bots siphoned approximately $29.7 million in gross value from Solana transactions, according to findings from blockchain analytics firm Bitquery. The data reveals that 96% of these detected attacks targeted the memecoin platform Pump.fun, specifically focusing on its launch curve and its PumpSwap exchange.

The study analyzed successful swaps and recorded 6,850,144 individual attacks carried out by 2,545 distinct bot wallets, impacting 2,154,994 unique addresses. These addresses do not equate to individual people, as trades originating from other automated bots accounted for 39% of the estimated gross extraction.

A sandwich attack occurs when a bot places a buy and a sell order around a regular user’s swap. The initial purchase by the bot drives up the pool price, forcing the intervening trader to acquire fewer tokens, after which the bot immediately unloads its holdings at the inflated price. This negative financial impact reaches the user through execution quality, even when the underlying transaction completes successfully.

Wide slippage marked greater exposure

Bitquery also observed that among trades routed via the swap aggregator Jupiter through Pump.fun’s launch curve or PumpSwap, those permitting a 20%–50% slippage tolerance were sandwiched 14 times more frequently than trades with a slippage tolerance under 3%.

Slippage tolerance defines the maximum permissible deviation between an expected quote and the final execution price. Documentation from Jupiter explains that this parameter establishes a minimum acceptable output amount. If prices move beyond that boundary, the swap fails, whereas a wider limit allows for a poorer fill rate. This creates a perpetual compromise between ensuring highly volatile trades execute successfully and minimizing unfavorable price concessions.

However, the recorded attack frequency did not scale uniformly with every broader slippage setting. Transactions with tolerance levels below 0.5% experienced more attacks than those set between 1% and 3%, while the bracket of 50% or higher encountered fewer attacks than the 20%–50% category.

This slippage comparison remains observational and focuses strictly on Jupiter routes interacting with Pump.fun’s launch curve or PumpSwap. Furthermore, Jupiter accounted for only a minor fraction of all victimized trades analyzed during the investigation.

The calculated $29.7 million figure evaluates SOL tokens at the exact minute of each individual attack and does not represent net profit. In a separate sample of 63 attacks analyzed by Bitquery, bots successfully kept 68% of their aggregate gross proceeds, though 18 attacks ultimately resulted in losses after accounting for costs. That subset does not determine net earnings for the entire evaluation window. Additionally, the report notes that inconsistent recording of Pump.fun sale fees skews the overall gross estimate by roughly 3%.

To identify the bots, Bitquery relied on recurring trading patterns, omitted round trips that initiated within a token’s first 10 slots, and accounted for existing gaps in exchange and block data. Because on-chain records cannot definitively prove that a bot inspected an order ahead of time, some of the flagged wallets may simply belong to exceptionally fast human traders.

While slippage parameters control the price a trader is willing to accept, a separate research preprint submitted on September 23, 2026, evaluated protected order flows—transactions designed to remain shielded from front-running—across six distinct blockchain networks. The authors discovered that sandwich patterns frequently span across multiple trades and blocks, leading them to conclude that these protective measures can offer significantly weaker guarantees than users typically anticipate.

?Frequently Asked Questions

01What is a sandwich bot attack?

A sandwich attack occurs when an automated trading bot detects a pending user transaction on a decentralized exchange, purchases the same asset beforehand to drive up the price, allows the user’s transaction to execute at a disadvantage, and then immediately sells its own holdings at the higher price to secure a profit.

02What platform was most targeted by Solana sandwich bots?

According to Bitquery’s data, 96% of the detected attacks targeted the memecoin platform Pump.fun, specifically focusing on its launch curve and its PumpSwap exchange.

03Does the $29.7 million figure represent net profit for the bots?

No. The $29.7 million estimate represents gross value extracted based on the price of SOL at the minute of each attack and does not account for operational costs, gas fees, or unprofitable trades.