Bitquery says sandwich bots pulled about $29.7 million before costs from Solana trades over an 11-month period. The blockchain data provider found that 96% of detected attacks hit memecoin platform Pump.fun’s launch curve and its PumpSwap exchange.
What the data counted
The investigation looked at successful swaps. It counted 6,850,144 attacks by 2,545 bot wallets, affecting 2,154,994 distinct wallets. Those wallet figures do not mean that many people were harmed. Other bots’ trades made up 39% of the estimated gross take, Bitquery said.
A sandwich is simple in outline. A bot buys before another trader’s swap, pushing the pool price up. The trader then gets fewer tokens. The bot sells into the higher price. The cost lands on the trader through execution, even if the swap goes through. That is why the loss can be easy to miss on a completed trade.
Wide slippage drew more attacks
Slippage tolerance mattered. Among swaps routed by Jupiter through Pump.fun’s launch curve or PumpSwap, trades allowing 20% to 50% slippage were sandwiched 14 times as often as those allowing under 3%, according to Bitquery.
Slippage tolerance sets how far a fill can move from a quote. A tight limit may cause a swap to fail when prices move. A wide limit lets the trade complete, but it accepts a worse price. That tradeoff may explain why some users set loose limits during fast markets.
The pattern was not perfectly linear. Trades below 0.5% tolerance were hit more often than those at 1% to 3%. The 50%-or-more band was hit less often than the 20% to 50% band. Bitquery called the slippage comparison observational. It also covered Jupiter routes through those two Pump.fun venues, and Jupiter carried only a small share of all victim trades in the study.
Profit estimate comes with caveats
The $29.7 million figure values SOL at the minute of each attack. It is not a net profit measure. In a separate 63-attack fee sample, bots kept 68% of aggregate gross proceeds. Eighteen of those attacks lost money after costs. That sample cannot prove net earnings for the full period. Bitquery also flagged inconsistent Pump.fun sale-fee recording that affects its gross estimate by about 3%.
Bitquery used repeated trading patterns to spot bots. It excluded round trips that began in a token’s first 10 slots and reported gaps in exchange and block coverage. Chain records cannot prove a bot saw an order ahead of time. Some qualifying wallets might be fast traders rather than sandwich attackers.
Slippage limits only control the price a trader will accept. A separate research preprint submitted Sept. 23, 2026, examined protected order flow across six blockchains. The authors found sandwich patterns that extended across trades and blocks. They concluded those protections can offer weaker guarantees than users expect.
