A malicious Ethereum validator exploited a flaw in the mev-boost-relay implementation by crafting an invalid block header with zero parent and state roots, bypassing validation and gaining visibility of block contents. The attacker front-ran and replaced MEV bot transactions to drain approximately $20M over 24 transactions.