The "MEV protection" that wasn't

August 2025. A trader in New York is concerned about MEV sandwich attacks on a planned $200K USDC → ETH swap. He searches "flashbots protect" and lands on flashbots-protect[.]io. The site mimics the real Flashbots design and asks him to "connect for protected routing." He connects and approves what the site calls a "session key" setup. In reality it hands control of his account to a contract the attacker runs. Two transactions later, his entire wallet — $283K — is gone, moved out through that delegation.

What Flashbots actually does

Flashbots Protect is a real service that routes transactions through a private mempool to prevent front-running and sandwich attacks. Its setup page is protect.flashbots.net, and the exact RPC address and options (such as the faster multi-builder setting) are listed in the official docs at docs.flashbots.net. Setup is adding that RPC endpoint to your wallet — no signature and no delegated authority required. Transactions broadcast through that endpoint skip the public mempool.

How the impersonation works

The fake site talks the user into granting "session key" authority — in practice, a delegation that lets an attacker-controlled contract act for his account — by claiming it is necessary for the protection to work. It is not. Delegation is real: session keys exist in smart-contract wallets, and EIP-7702 lets an ordinary account point to contract code. But no MEV protection service requires either. The delegation is the drain mechanism.

The three rules for "MEV protection" services

  • Real MEV protection changes how your transaction is sent, not who can sign for you. Flashbots Protect and MEV Blocker are RPC endpoints you add to your wallet; CoW Swap protects trades by settling them in batch auctions. None of them asks you to delegate control of your account.
  • Take the address from the official docs, not from search results. Flashbots Protect is set up from protect.flashbots.net, MEV Blocker from mevblocker.io, CoW Swap lives at cow.fi. Lookalike domains such as flashbots-protect[.]io or mev-blocker[.]com are the trap; judge a site by its full domain, not by its design.
  • Delegation requests are advanced operations. If a site asks you to set up session keys, "upgrade" your account, or delegate to a contract, and you did not start that from your wallet's own settings, decline. If you cannot say exactly what authority you are granting and to which address, decline.

The recovery

If you granted a delegation like this: move whatever is left to a fresh wallet right away — the attacker usually acts faster than you can undo anything. Then clear the delegation if your wallet offers that option, and revoke token approvals on the old address. Treat the old wallet as permanently compromised and do not use it again.

The deeper lesson

Sophisticated traders are the highest-value targets. Scams aimed at them use the language of the trading community — MEV, sandwich attacks, session keys, account abstraction. Real protection comes from understanding what each term actually means and being able to verify whether a given action is consistent with what is being claimed.