DOJ charges 2 brothers tied to $25M attack on MEV bots last year

The two brothers were arrested in New York and Boston, and they face two courts later Wednesday

article-image

Kristi Blokhin/Shutterstock modified by Blockworks

share

Two brothers accused of orchestrating an attack last year on Ethereum trading bots have been indicted by the US government. 

The Department of Justice unsealed charges against Anton Peraire-Bueno and James Peraire-Bueno on Wednesday.

The pair are charged with conspiracy to commit wire fraud, wire fraud, and conspiracy to commit money laundering after the brothers allegedly tried to “exploit the very integrity of the Ethereum blockchain to fraudulently obtain approximately $25 million worth of cryptocurrency within approximately 12 seconds.”

Both were arrested on Tuesday and will face judges in Massachusetts and New York. 

The April 2023 exploit targeted bots that seek profit by essentially trying to front-run transactions on the network. Maximum extractable value, or MEV, referring to the maximum value that can be obtained during transaction block production beyond rewards and fees. 

Read more: Ethereum Validator Goes Rogue, Frontruns MEV Bots for $25M

The Peraire-Bueno brothers sought to “lure” MEV bots from the traders they allegedly targeted by “proposing at least eight specific transactions that…the defendants knew would cause the” targeted bots to include the lure transactions in the bundles, the indictment said. The exploit took advantage of a since-patched code vulnerability in the MEV-Boost software. 

“In each of these eight bundles, the victim traders effectively bought substantial amounts of particularly illiquid cryptocurrencies…for approximately $25 million of various stablecoins.” 

“Through the Exploit, which is believed to be the very first of its kind, Anton Peraire-Bueno and James Pepaire-Bueno manipulated and tampered with the process and protocols by which transactions are validated and added to the Ethereum blockchain. In doing so, they fraudulently gained access to pending private transactions and used that access to alter certain transactions and obtain their victims’ cryptocurrency,” a DOJ press release said. 

To avoid detection, the two tried to conceal their identities through shell companies and private crypto addresses. 

Following the attack, the brothers even “transferred the stolen cryptocurrency through a series of transactions designed to conceal the source and ownership of the stolen funds.”

They researched know-your-customer (KYC) procedures online, per the indictment, to learn the KYC standards and extradition procedures. They allegedly also researched the crimes they’d end up being charged with.

“As alleged in today’s indictment, the Peraire-Bueno brothers stole $25 million in Ethereum cryptocurrency through a technologically sophisticated, cutting-edge scheme they plotted for months and executed in seconds,” said Deputy Attorney General Lisa Monaco.


Get the news in your inbox. Explore Blockworks newsletters:

Tags

Decoding crypto and the markets. Daily, with Byron Gilliam.

Upcoming Events

Javits Center North | 445 11th Ave

Tues - Thurs, March 24 - 26, 2026

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

Old Billingsgate

Mon - Wed, October 13 - 15, 2025

Blockworks’ Digital Asset Summit (DAS) will feature conversations between the builders, allocators, and legislators who will shape the trajectory of the digital asset ecosystem in the US and abroad.

recent research

Unlocked by Template (1).jpg

Research

As AI supercharges surveillance, privacy becomes a prerequisite and the winning stack will combine confidentiality with selective disclosure. Zcash’s Tachyon, composable standards on Ethereum/Solana, and compliance-aware pools aim to make private rails the new norm.

article-image

The startup says it aims to rival Stripe and Worldpay by using stablecoins to speed merchant settlements from days to seconds

by Blockworks /
article-image

“S&P 500” for crypto comes as segment gains “established role in global markets,” S&P exec says

article-image

The S&P Digital Markets 50 Index combines 15 cryptocurrencies with 35 crypto-linked companies, offering investors hybrid exposure

by Blockworks /
article-image

Gnosis is betting that openness — not ownership — will define the future of onchain money

article-image

Crypto’s quest to imbue shareholder protections for tokens

article-image

Grass previously raised a seed and Series A rounds and plans to utilize the token purchase to execute on its roadmap