Solana Sandwich Attacks Now Detectable Using Public Blockchain Data

A new method allows Solana users to detect sandwich attacks — a form of MEV exploitation — directly from their own wallet history using publicly available on-chain data. Since January 23, 2026, Solana's address history API began including each transaction's position within its block, making it possible to precisely locate a swap at a specific slot and index. A sandwich attack follows a three-step pattern: a bot buys a token just before a victim's trade, the victim executes at a worse price, and the bot immediately sells to pocket the difference. Data from a live tracker recorded approximately 8,700 SOL extracted daily in mid-September 2026, affecting around 74,000 distinct victim wallets in a single 24-hour period at an average cost of roughly $12 per affected swap. Reliable detection requires analyzing balance changes across transactions rather than just shared accounts, and must account for cases where the attacker's sell leg lands in the following block rather than the same one.