Binance was hacked for 6.3 billion USD, yet Titan Builder made a staggering 22.83 million USD in a single day, topping the revenue chart
*Author: Gu Yu, ChainCatcher*
In the last day, a name that most people have never seen appeared at the top of DefiLlama's protocol revenue rankings.
In first place is [Titan Builder](https://www.rootdata.com/zh/projects/detail/Titan%20Builder?k=MjYyMzU%3D "Neutral Block Builder on Ethereum"), with a revenue of 22.83 million dollars in the past 24 hours; second is Tether, with 16.99 million dollars; third is Circle, with 6.76 million dollars. It is not a stablecoin company, not an exchange, nor a popular protocol, but a company headquartered in London with only sixteen employees that never publicly promotes itself.
What it does is sort transactions on Ethereum—deciding which transactions to include in each block and in what order. This position has become the most profitable place on the entire chain in the past forty-eight hours.
### 1. How a Theft Transformed Protocol Revenue
To understand this money, we must first talk about the theft itself.
A large portion of the assets stolen by the hacker was USDT and USDC. These types of assets have a fatal characteristic: the issuer can freeze them. Tether acted the next day, freezing an additional 1.5 billion dollars. Therefore, the hacker had to exchange this money for something that could not be frozen—tokens from Ethereum and Tron.
Speed is security, but speed comes at a price.
From 4:34 AM to 4:49 AM Beijing time on October 30, the hacker used two "sign off-chain first, then have institutions execute" order channels to buy 122,316 ETH with 325 million USDT, at an average transaction price of 2,657 dollars—while the market price at that time was 2,284 dollars. This transaction overpaid by 45.7 million dollars. Fifteen minutes later, it bought directly from the on-chain liquidity pool, overpaying another 25.8 million.
In total, buying ETH resulted in an overpayment of 71.5 million dollars. Selling the stolen UNI, PEPE, ENA, LINK, AAVE, and other tokens at a loss amounted to 24.8 million. Buying TRX on Tron resulted in an additional overpayment of 22.4 million. The total came to 119 million dollars, all priced within an hour.
This excess money did not disappear into thin air; it was caught by those on the other side of the trade.
In Ethereum's largest ETH/USDT liquidity pool, the price of ETH was once 38% higher than the market. This is an outrageous price difference; on a normal night, such opportunities often yield only a few cents in profit. Thus, tens of thousands of wallets rushed in, selling ETH into the high-priced pool and buying the stolen tokens at low prices.
As more people rushed in, they had to queue; to cut in line, they had to pay.
That night, according to blockchain analysis firm Bitquery, the tips paid by bots to block builders amounted to **10,251 ETH**. The previous night during the same time period, this number was **4.6 ETH**. In one night, it increased by more than two thousand times. That same night, there were also 10,235 failed transactions (the previous night there were 3,500), each still incurring transaction fees.
The final bill was divided as follows: traders and their bots took home 59.9 million dollars; the company sorting the transactions and the validating nodes took 29.5 million; depositors in the liquidity pool received 20.2 million; and the institutions facilitating the trades got 6.7 million.
It is worth mentioning that those who rushed in did not necessarily profit. The most well-known arbitrage bot on Ethereum, jaredfromsubway, managed to capture a discount space worth 2.87 million dollars from that batch of tokens sold at a loss but paid 2.95 million dollars in queue fees, resulting in a loss of 110,000 dollars. Another wallet captured 3.24 million but paid 3.51 million, resulting in a loss of 820,000 dollars.
**The winner is the one collecting the toll.** The total network fees on Ethereum that day jumped from 44.25 million dollars to 56.4 million dollars, reaching a new high since April, while the usual transaction fee is less than a cent.
### 2. Who is Titan Builder
The parent company of Titan Builder is called Gattaca, founded in London in 2018, originally named Day 0 Dynamics, focusing on proprietary trading. In early 2023, it launched Titan Builder, transitioning to infrastructure.
Founder Kubi Mensah is an alumnus of Y Combinator S15 batch and previously co-founded a mobile security company that successfully exited. Co-founder Philip Gasslander also comes from YC and has worked at Google, while another, Fabrizio Cavallo Marincola, holds a PhD in computational fluid dynamics from Imperial College. To date, the team consists of only sixteen people, primarily engineers, with a product iteration cycle of two weeks.
One of its key self-positionings is: **not engaging in proprietary trading.** Mensah repeatedly emphasizes that this is a service business—what they earn is not from their own bets, but from the service fees for sorting transactions and guaranteeing "this transaction will be added to the chain in this order" for others. This also explains why its revenue surged this time but was unrelated to the market: it has never bought a single ETH from start to finish.
Gattaca currently has five layers on the Ethereum chain, covering the entire process from transaction generation to being added to the chain:
* **Titan Builder**: Responsible for packaging blocks, currently about half of Ethereum's blocks are constructed by it;
* **Titan Relay**: Responsible for delivering blocks to validating nodes, **connecting to over 90% of Ethereum's validators**;
* **Nova**: A one-stop transaction execution and anti-sandwich service for ordinary users and wallets;
* **Kairos**: Seizing the "priority channel" on Arbitrum, holding it for about seventy percent of the time;
* **Based OP**: An open-source sorter provided for Optimism.
It is necessary to clarify the difference between "builders" and "relays." Builders are the ones who determine the order of transactions; validators are randomly selected and ultimately add the block to the chain. The two do not trust each other, requiring a guarantor in between—the relay. When Bitquery tracked the flow of funds that night, it found that most of the money paid to validators **went through Titan's payment relay**.
It simultaneously holds the "sorting rights" and "the access pipeline for ninety percent of validators," and the combination of these two identities explains why it is the biggest beneficiary in this incident. Records from DefiLlama show that Titan's revenue in normal months ranges from 3 million to 10 million dollars.
### 3. Half of Ethereum and the Changes Around It
Three builders control the vast majority of Ethereum's blocks—this is the title of an episode from the podcast Epicenter in April this year, describing Titan, its peers, and the oligopolistic structure of this market.
In terms of share, different institutions have slightly different figures: Gattaca's official website states "about 50%," while third-party site rated.network shows 52.04%, approximately 2.8 times that of the second place; another independent monitoring site captured 48.3% in twenty-four-hour data on October 26. Regardless of which number is taken, "close to or exceeding half" is the consensus, and this position has been held since August 2023.
The forms of competitors vary. The former share leader Beaverbuild now has only 0.13% in the latest independent monitoring; rsync-builder, supported by Coinbase Ventures, focuses on low latency on the US East Coast; BuilderNet, initiated by Flashbots and operated by multiple operators, is the most decentralized, with about 9.79% share.
Most notably is Flashbots. It once produced sixty to seventy percent of Ethereum's blocks, but now it has only 8% to 12%. However, this is not a collapse but a **voluntary retreat**—it has redirected its focus to relays, auction mechanisms for user transaction rights, and cross-chain facilities, effectively abandoning this most lucrative market.
This has created an interesting contrast: both Titan and Flashbots engage in sorting and relay services, but Flashbots chose to build public infrastructure and give up market share, while Titan chose to occupy the largest share while also holding access to ninety percent of validators. Both paths are still viable today, but the latter is clearly more profitable.
Its moat is not mysterious. Mensah described a cycle: the better the service, the more transactions queue up; the more transactions, the more valuable the packaged blocks; the more valuable the blocks, the more validators and institutions are willing to cooperate with it. Currently, over half of the transactions on Ethereum do not even go through the public waiting area, being sent directly through private channels—whoever has more access has more materials. The remaining part is millisecond-level engineering capability, along with a more fundamental element: trust. Bots must hand over their strategies to builders, and if they underperform a few times, they will switch to someone else.
It is worth mentioning that Gattaca, which occupies half the market, has initiated an industry organization called Blockspace Forum, specifically discussing "what to do about excessive concentration of block allocation."
### Conclusion
In fact, this is the second time Titan Builder has topped the single-day revenue rankings this year.
The last time was in March: someone filled in the slippage parameter incorrectly, and 50.43 million dollars was distributed across a block—in twelve seconds—throughout the entire chain, and it took about 34 million. This time, an exchange was emptied, and the hacker frantically exchanged tokens, and it took 22.83 million.
**Between the two instances, there was not a single time that it did something right. It just happened to be in the same position during both chaotic events.**
A company of sixteen people has occupied the packaging rights for half of Ethereum's blocks in three years and connected to over ninety percent of validators. Its founder claims this is purely a service industry. This statement is correct—only the price of this service does not depend on how well it performs, but on how panicked the chain is.
And in its four peaks of revenue from collapses, two came from the disasters of others.