Cross-Chain MEV: How Bots Extract Value When You Move Between Chains

In December 2021, someone spotted a strange gap in the market: Uniswap V2 on Ethereum would let you swap 238,172 MATIC for 116.97 WETH. Bridge that WETH over to Polygon, swap it back into WMATIC, and you'd walk away with 288,033 WMATIC - a profit of roughly $111,688, for doing nothing more than moving the same trade across a bridge. Researchers at Flashbots documented it as one of the first clean examples of value that only exists because a transaction crosses chains.

That gap wasn't a fluke. It was the opening move in what's now a well-studied, well-funded, and increasingly automated corner of DeFi: cross-chain MEV. If you've read our primer on what cross-chain MEV is, you already know the shape of the problem. This piece goes one level deeper - into the actual mechanics bots use to extract value the moment your assets leave one chain and haven't yet landed on another, using data from the research groups who've spent the last two years measuring it.

The core problem: your trade takes time, and time is inventory for bots

A same-chain swap settles in one block. A cross-chain swap doesn't - it involves a source-chain transaction, a bridging or messaging step, and a destination-chain transaction, and none of those three steps are guaranteed to happen in the same moment, or even the same minute. Flashbots researcher Alex Obadia and co-authors formalized this in 2021: they defined "cross-domain MEV" as extractable value that depends on the joint ordering of actions across two or more chains, not just one. Every chain is its own "domain" with its own sequencer or validator set, and the seams between domains - bridges, messaging layers, deposit queues - are where the value leaks.

That gap between "signed on Chain A" and "settled on Chain B" is exactly what bots are built to live inside.

The bot's playbook: 3 distinct techniques

1. Inventory arbitrage - skip the bridge entirely

The single biggest finding from the most comprehensive study of executed cross-chain arbitrage to date might surprise you: most bots don't actually bridge anything. Researchers tracking nine blockchains over a full year identified 242,535 executed cross-chain arbitrages worth $868.64 million in volume - and 66.96% of them used pre-positioned inventory sitting on both chains already, rather than moving assets through a bridge in real time.

That's worth pausing on, because it reframes what cross-chain MEV mechanically is. The intuitive picture - a bot watching your bridge transaction and racing to beat it to the other side - describes a minority of activity. The dominant strategy doesn't touch a bridge at all. Here's what it actually looks like: a bot keeps a working balance of, say, USDC on Arbitrum and USDC on Base at the same time, and watches the price of the same token pair on a DEX on each chain in real time.

The moment that pair is priced meaningfully differently between the two - enough to clear gas and fees - the bot sells on the expensive side and buys on the cheap side, in the same few seconds, using capital it already has sitting in both places. No bridge required to capture the spread; if any bridging happens, it's a separate, unhurried step later on to rebalance the two balances back to where the bot wants them. It's the same instinct as an arbitrage bot watching the same asset across two DEXs on one chain - just applied across two chains instead, which means the bot needs a balance sheet split across both to even play.

The logic for why bots prefer this is simple: bridging is slow, and slow kills arbitrage. Trades using pre-funded inventory on both ends settled in a 9-second median. Trades that had to route an asset through a bridge - because the bot didn't have capital already in place and had to physically move it to seize the opportunity - took a 242-second median, roughly 27 times longer. For a bot competing against dozens of others for the same few seconds of price divergence, that gap is the whole game.

And that need for pre-funded capital on every chain is exactly what concentrates this market into a small number of hands. This is not a level playing field of independent bots: the same study found the five largest addresses executed more than half of all detected trades, and one address alone captured close to 40% of daily volume in the months after Ethereum's Dencun upgrade cut rollup costs in March 2024.

Keeping idle working capital ready across nine-plus chains at once is expensive - only a handful of well-capitalized operators can afford to do it at the scale needed to compete, which is why cross-chain arbitrage is dominated by a few key players rather than spread across a long tail of smaller bots. That concentration isn't a side note; it's the same dynamic behind the vertical-integration risk covered further down.

2. Cross-layer sandwich attacks - no mempool required

Sandwich attacks are old news on Ethereum's public mempool. What's newer is that they've been shown to work against rollups that don't even have a public mempool - by attacking the bridge deposit step instead of the trade itself.

Researchers from ETH Zurich and Northeastern University demonstrated three working strategies against Arbitrum and Optimism, all exploiting the same quirk: when you deposit funds from Ethereum into a rollup, that deposit transaction is visible in Ethereum's public mempool before it's processed on the rollup - even though the rollup's own mempool is private.

• Classical sandwiching - the bot watches Ethereum's mempool for L1-to-L2 deposit transactions that will trigger a swap, then sandwiches the deposit itself, so the price manipulation lands on the L2 side once the deposit clears.

• Hybrid sandwiching - the bot places its front-running leg on L1, then races straight to the L2 sequencer for the back-running leg, exploiting the fact that sequencers place incoming L1 deposits at the top of the next L2 batch - a deterministic slot the bot can plan around.

• Speculative sandwiching - the bot skips L1 entirely, waiting instead for the rollup's timeout window (the delay before a sequencer pulls a pending L1 deposit into an L2 batch) and sandwiching it purely on L2, which is cheaper to execute.

The researchers estimated attackers had already extracted close to $2 million this way, almost entirely from users bridging through the Hop Protocol. The takeaway isn't that any one bridge is uniquely at fault - it's that "the rollup has no public mempool" is not the same thing as "the rollup is invisible to bots." The visibility just moves up a layer, to wherever your deposit transaction first gets broadcast.

3. Multi-hop arbitrage - rare, slow, and often not even worth it

It's tempting to imagine bots chaining arbitrage across three or four chains at once, extracting value at every hop. In practice, the data says this barely happens. A 2026 systematization of MEV research scanned 12 blockchain networks, 45 bridges, and over 2.4 billion transactions looking for genuine multi-hop (three-chain-plus) arbitrage - and found only ten instances: eight three-hop trades and two four-hop trades, no five- or six-hop trades at all.

The ones that did happen weren't pretty: three-hop arbitrage took an average of 7.2 minutes to execute, four-hop took 11.6 minutes, and only 60% of attempts were actually profitable once execution risk and fees were accounted for. Every additional hop adds latency, adds a chance something reverts partway through, and adds a chain's worth of gas costs - which is precisely why the profitable, high-volume end of cross-chain MEV concentrates on simple two-domain trades with pre-positioned capital, not elaborate multi-chain chains.

Why this behaves differently from single-chain MEV

Three structural facts explain why cross-chain MEV rewards a different kind of operator than single-chain MEV does:

• No atomicity. On one chain, a searcher can bundle a front-run, the victim's trade, and a back-run into a single atomic block - it either all happens or none of it does. Across chains, that guarantee disappears. A bot can execute perfectly on Chain A and still get stuck holding an asset it can't offload if Chain B's price moves before the second leg lands.

• Capital beats cleverness. Because bridging is slow, the fastest strategy is to not bridge at all - which means having capital parked and ready on every chain you want to trade on. That's a balance-sheet requirement, not just a technical one, and it structurally favors well-funded operations over solo searchers.

• It rewards vertical integration. The same research groups tracking this space flag a genuine systemic concern: sophisticated searchers have an incentive to pair up with - or become - the infrastructure operators who sequence transactions (rollup sequencers, large validator operators). When the entity ordering transactions is also the entity extracting MEV from them, you get censorship, liveness, and finality risks that compound across every chain that operator touches.

What this looks like from where you're sitting

Say you're swapping USDC on Arbitrum for ETH on Base. Somewhere in that flow, one or more of the following is a live possibility, depending on how the route is built:

1. Your deposit or bridge transaction sits in a public mempool for some window of time before it's finalized - exactly the window cross-layer sandwich bots are built to watch.

2. The price on the destination chain can move between when you signed and when your funds actually arrive, and a bot with pre-positioned inventory on both chains can beat you to the resulting arbitrage.

3. If your route depends on a relayer or a third-party liquidity provider to complete the second leg, that party has some discretion over timing - and timing, as we've seen, is the entire resource being fought over.

None of this requires a hack or a bug. It's the predictable output of a multi-step, non-atomic process being watched by well-resourced, automated participants. That's also why it's worth being precise about the distinction between cross-chain MEV and cross-chain bridge hacks - they're related but different threats. MEV extraction skims value from the ordering and timing of legitimate transactions; a bridge hack is a direct exploit of the bridge's smart contracts or validator set. Both matter, but they call for different defenses - we've covered bridge security separately if you want the full picture, including why bridge hacks alone accounted for roughly $2.3 billion in losses in 2025.

How the ecosystem is responding

A few mitigations are gaining real traction, each attacking a different part of the problem:

• Private transaction relays (Flashbots Protect, MEV Blocker, and similar RPC endpoints) keep your transaction out of the public mempool entirely, closing off the visibility that classical and hybrid cross-layer sandwiching both depend on.

• Batch auctions and uniform clearing prices settle a group of orders together at one price, discovered off-chain through solver competition, rather than executing trades one at a time in a sequence a bot can insert itself into. This is the mechanism CoW Protocol is built around, and it's also the reasoning behind extending solver competition to the bridging leg of a trade - CoW Swap sources cross-chain routes from multiple bridge partners, including Across and Bungee, bundling the swap and the bridge into a single signed intent instead of leaving each leg separately exposed.

• Decentralizing block and batch building is the structural fix researchers point to most consistently - the more concentrated sequencing power gets, the more cross-chain MEV rewards vertical integration between searchers and infrastructure operators. Spreading that power back out is a direct countermeasure to the concentration data above.

• SUAVE and similar shared-sequencing designs aim to let searchers compete for cross-domain execution rights through an auction layer that isn't controlled by any single chain's sequencer - still early, but aimed squarely at the collusion incentive Obadia's original paper flagged back in 2021.

The practical takeaway

Cross-chain MEV isn't going away - it's a direct consequence of DeFi being multi-chain, and the research suggests it's growing (cross-chain arbitrage volume grew 5.5x over the year researchers studied). But it's also more concentrated, more capital-intensive, and more mechanically specific than it might sound. It isn't some bot randomly front-running you mid-bridge; it's inventory-rich operators racing a 9-second clock, and mempool-watchers exploiting the exact moment your deposit becomes visible before your rollup processes it.

The practical version of "protect yourself" looks like this:

• Prefer routes that avoid unnecessary time in a public mempool.

• Understand that a cross-chain swap is not one transaction - it's a sequence, and every seam in that sequence is a place value can leak.

• Where possible, use aggregated or intent-based routing that bundles the swap and bridge legs, rather than manually sequencing them yourself across multiple tabs and multiple minutes.