The hacker paid a "panic tax" of 119 million dollars, and the person who took this money is probably someone you haven't heard of

*Author: [Kent Lin](https://x.com/kentlinyy/status/2116441054878769577?s=46)*

The hacker stole billions, and just the currency exchange step cost about 119 million dollars.

Who took this money? Most Binance users probably haven't heard the name.

On October 30, a block builder on Ethereum collected more fees in one day than Tether. So much that DefiLlama's own system initially thought it was dirty data and blocked it.

I guess everyone has seen the screenshot. The statement by the godfish @bitfish, "There is no right or wrong on-chain, only speed," is very accurate, and I have nothing to add.

What I'm more curious about is what happened afterward: how much did the fast ones take, and where did the money finally stop? So I spent some time tracing this money down, and here’s what I found.

### 01｜The Hacker's "Panic Tax"

Put yourself in their shoes: you have billions in stolen funds, and for every hour you delay, more money gets frozen. At this point, you don't care about the price.

So they did something a normal trader would never do: large amounts, on-chain, in a hurry, taking whatever price the pool offered.

Bitquery calculated that, at market price, these exchanges lost about 119 million dollars in total.

The most outrageous moment was at UTC 21:09, which is 5:09 AM Singapore/Beijing time on October 30. In the Uniswap main WETH/USDT pool, ETH was bought at a price 38% higher than the market price. The one buying at that price was none other than the hacker themselves.

The selling direction was also losing; coins like UNI, PEPE, and ENA were sold off at low prices, resulting in a loss of 24.8 million dollars.

Compared to Binance's estimated impact of 6.3 billion dollars, this amount is less than 2%. But it was still a nine-digit transfer, moving from a panicked seller to the fastest hands at that time. The entire process was on a public blockchain, and anyone could check it.

### 02｜Money Flows Down Layer by Layer

Looking down from this 119 million, it’s roughly divided as follows:

1. The hacker's bad trades became good trades for others. Arbitrage traders and bots, after deducting gas and tips for the builder, kept about 60 million dollars for themselves.

2. These bots were targeting the same batch of price-disordered pools, and to be first, they could only pay the block builder to prioritize their transactions on Ethereum. As a result, about 30 million dollars flowed into the builder and validators' hands.

3. The builder then transferred most of this to the validators, as Bitquery stated.

What remained in the builder's pocket was their actual business.

Titan reported earnings of 13.13 million dollars in a 24-hour window, which was already after paying the validators. Their total earnings for September were only 4.66 million, averaging about 155,000 dollars a day. This means that this one day was 2.8 times their monthly earnings.

Here, I need to clarify the metrics because these numbers don't match and shouldn't match. Bitquery only tracked the hacker's own cash flow; DefiLlama counted everything Titan handled during that window. 0xngmi also mentioned that besides the hacker's currency exchange, the overall market panic itself was creating arbitrage opportunities. Different windows lead to different totals: Nick Research reported Titan's fees as 14.91 million dollars, while DefiLlama's 24h leaderboard showed 24.68 million.

Just to correct a mistake. Many posts referred to the 24.68 million as "revenue," but strictly speaking, that is the fee; revenue must deduct the part paid to validators.

However, it doesn't matter which version you look at; the direction is the same.

### 03｜Toll Collectors Earn More Than Store Owners

On that day, the top few on DefiLlama's 24h fee leaderboard were as follows:

Titan Builder: 24.68 million dollars

Tether: 16.99 million

Flashbots: 13.73 million

Uniswap: 12.89 million

Ethereum: 10.82 million

Hyperliquid was even further down, at 6.36 million.


Note the fifth line. A company that helps package blocks on Ethereum collected more fees than Ethereum itself.

To be fair, the metrics are not entirely the same; the builder's fees include MEV payments, while the chain counts gas. But even if we discount it, this ranking clearly shows where the money is flowing.

Extending it to 7 days is similar. Titan's 7-day earnings were 25.95 million dollars, with only Tether (103 million) and Circle (40.88 million) ahead. Hyperliquid, often used as a "true revenue" benchmark, had 14.1 million over 7 days.

The industry's attention has mostly been on the application layer, with exchanges and Perp DEX being the most discussed. As a result, when a 6.3 billion dollar hole dropped, the money ultimately flowed to the layer that determines transaction order. Honestly, it's a bit ironic.

### 04｜Whoever is Fast Gets the Meat

Friends in Ethereum might not feel comfortable with this section, so let me say hello first.

The little money builders usually earn is so small that no one wants to write a post about it. But in a crisis, ordering becomes everything. Every bot wants to be the first to pounce on the same broken pool; whoever sees more order flow and blocks faster wins this auction.

On the same leaderboard, BeaverBuild's fees were 2.56 million, while Titan's were 24.68 million. The same activity, on the same chain, but nearly a 10-fold difference. The three builders on the list combined had about 60% of the fees going to Titan alone, especially on a day when block ordering was worth tens of millions of dollars. When pressure mounts, concentration becomes this extreme.

I find this quite relatable because what we do at Optimum (@get_optimum) is all about how fast block data transmits within the Ethereum network. Our CEO Muriel Médard is an MIT professor and a co-inventor of RLNC (Random Linear Network Coding), and we use this coding to accelerate block propagation among validators, just launched on the Ethereum mainnet on October 20.

To clarify, we are not builders and do not engage in ordering. But over the years, when discussing "how much is a few hundred milliseconds worth" with validators, they often nod but don’t feel much. This week, I don’t need to explain anymore; the leaderboard speaks for me: when ordering becomes valuable, latency directly turns into revenue, and this time it was tens of millions of dollars in one day.

### 05｜Flashbots Collected Fees but Gave All the Money Away

During the same 24 hours, Flashbots recorded 13.73 million dollars in fees, but DefiLlama calculated its own revenue as: 0.

According to DefiLlama's definition, this is the ETH paid by users to block validators, which goes directly through Flashbots to the validators. Titan, on the other hand, kept 13.13 million for itself.

In the same MEV flow, Flashbots acts more like a road builder, returning value to those maintaining the chain; Titan is a profitable business, earning with justification.

I don’t think anyone did anything wrong. The Ethereum community has spent years trying to push the value of MEV back to validators, and yet on such a day, the one keeping the money was the most profitable full-stack entity.

Which is a business and which is a public good is clear to everyone. What I truly don’t understand is: if another crisis comes, which model will win?

### 06｜What Role Does Binance Play in This?

Binance has stated that the SAFU and company funds will cover all user losses. So this panic tax is not being paid by users; it’s being borne by Binance's balance sheet.

There’s another angle I think not many people have mentioned: every dollar the hacker lost on slippage is a dollar that cannot enter the mixer. That night, in a sense, the arbitrage bots did something good, even though no one was aiming for that.

CEO Qin @qinbafrank asked today: "Does this count as helping the hacker launder money?"

I’m stuck on this question because both sides make sense. The builders who earned a record-breaking day were the ones packaging the hacker's exchanges into blocks.

### 07｜I’m Taking a Bet

If another exchange of this magnitude gets emptied out, top builders will likely be publicly called out: in the first few hours, refuse to package the attackers' transactions.

Some will comply. Those who don’t will take that order flow along with the fees.

I bet that before the end of 2026, at least one top builder will issue a written "stolen funds handling policy." I’ll take another bet that on the day it’s released, Ethereum Twitter will be split into two factions.

From the perspective of those of us working at the network layer, I have another judgment: the "few hundred milliseconds" that used to be ignored will become increasingly expensive.

Which side will you stand on, refuse to package, or remain neutral?

@evilcos, Teacher Yu Cosine, has been in security for many years, and I’d really like to hear your thoughts: should builders act as this gatekeeper?