Binance was hacked for 6.3 billion USD, yet Titan Builder made a staggering 22.83 million USD in a single day, topping the revenue chart

Author: Gu Yu, ChainCatcher

In the last day, a name that most people have not seen appeared at the top of DefiLlama's protocol revenue list.

In first place is Titan Builder, with a revenue of 22.83 million dollars in the last 24 hours; second is Tether, with 16.99 million dollars; third is Circle, with 6.76 million dollars. It is not a stablecoin company, not an exchange, nor a popular protocol, but a company headquartered in London with only sixteen employees that never publicly advertises itself.

What it does is sort transactions for Ethereum—deciding which transactions to include in each block and in what order. This position has become the most profitable place on the entire chain in the past forty-eight hours.

1. How a Theft Transformed Protocol Revenue

To understand this money, we must first talk about the theft itself.

A large portion of the assets stolen by the hacker was USDT and USDC. These types of assets have a fatal characteristic: the issuer can freeze them. Tether acted the next day, freezing an additional 1.5 billion dollars. Therefore, the hacker had to exchange this money for something that no one could freeze—tokens from Ethereum and Tron.

Speed is security, but speed comes at a price.

From 4:34 AM to 4:49 AM Beijing time on October 30, the hacker used two "sign off-chain first, then have institutions execute" order channels to buy 122,316 ETH with 325 million USDT, at an average transaction price of 2,657 dollars—while the market price at that time was 2,284 dollars. This transaction overpaid by 45.7 million dollars. Fifteen minutes later, it bought directly from the on-chain liquidity pool, overpaying another 25.8 million.

In total, buying ETH resulted in an overpayment of 71.5 million dollars. Selling the stolen UNI, PEPE, ENA, LINK, AAVE, and other tokens at a loss incurred 24.8 million. Buying TRX on Tron resulted in an additional overpayment of 22.4 million. The total amounted to 119 million dollars, all priced within an hour.

This excess money did not disappear into thin air; it was caught by those on the other side of the trade.

In the largest ETH/USDT liquidity pool on Ethereum, the price of ETH was once 38% higher than the market. This is an outrageous price difference; on a normal night, such opportunities often yield only a few cents of profit. Thus, tens of thousands of wallets rushed in, selling ETH into the high-priced pool and buying the stolen tokens at a low price.

As more people rushed in, queues formed; to cut in line, one had to pay.

That night, according to blockchain analysis firm Bitquery, the tips paid to block builders by bots amounted to 10,251 ETH. The previous night during the same time period, this number was 4.6 ETH. In one night, it increased by over two thousand times. On the same night, there were also 10,235 failed transactions (the previous night had 3,500), each still incurring transaction fees.

The final bill was divided as follows: traders and their bots took away 59.9 million dollars; the company sorting the transactions and the validating nodes took 29.5 million; depositors in the liquidity pool received 20.2 million; and the institutions facilitating the trades received 6.7 million.

It is worth mentioning that not everyone who rushed in made a profit. The most well-known arbitrage bot on Ethereum, jaredfromsubway, managed to capture a discounted value of 2.87 million dollars from that batch of tokens sold at a loss but paid 2.95 million dollars in cutting-in fees, resulting in a net loss of 110,000 dollars. Another wallet captured 3.24 million but paid 3.51 million, resulting in a loss of 820,000 dollars.

The winner is the one collecting the toll. The total network fees on Ethereum that day jumped from 44.25 million dollars to 56.4 million dollars, reaching a new high since April, while the usual transaction fee is less than a cent.

2. Who is Titan Builder

The parent company of Titan Builder is Gattaca, founded in London in 2018, originally called Day 0 Dynamics, focusing on proprietary trading. In early 2023, it launched Titan Builder, transitioning to infrastructure.

Founder Kubi Mensah is an alumnus of Y Combinator S15, having previously co-founded a mobile security company and successfully exited. Co-founder Philip Gasslander also comes from YC and has worked at Google, while another co-founder, Fabrizio Cavallo Marincola, holds a PhD in computational fluid dynamics from Imperial College. To date, the team consists of only sixteen people, primarily engineers, with a product iteration cycle of two weeks.

One of its key self-positions is: not engaging in proprietary trading. Mensah repeatedly emphasizes that this is a service business—earning not from betting their own money, but from sorting for others and guaranteeing that "this transaction will be included in this order" as a service fee. This also explains why its revenue surged this time but was unrelated to the secondary market conditions.

Gattaca currently has five layers deployed on the Ethereum chain, covering the entire process from transaction generation to on-chain inclusion:

• Titan Builder: Responsible for packaging blocks, currently constructing about half of Ethereum's blocks;

• Titan Relay: Responsible for delivering blocks to validating nodes, connecting over 90% of Ethereum's validators;

• Nova: A one-stop transaction execution and anti-frontrunning service for ordinary users and wallets;

• Kairos: Seizing "priority lanes" on Arbitrum, holding about seventy percent of the time;

• Based OP: An open-source sorter provided for Optimism.

It is necessary to clarify the difference between "builders" and "relays." Builders are the ones deciding the order of transactions; validators are randomly selected individuals who ultimately add the block to the chain. The two do not trust each other, requiring a guarantor in between—the relay. When Bitquery tracked the flow of funds that night, it found that most of the money paid to validators went through Titan's payment relay.

It simultaneously holds both "sorting rights" and "the access pipeline for ninety percent of validators," and this dual identity explains why it is the biggest beneficiary in this incident. DefiLlama's records show that Titan's revenue in normal months ranges from 3 million to 10 million dollars.

3. Half of Ethereum and the Changes Around It

Three builders control the vast majority of Ethereum's blocks—this is the title of an episode from the podcast Epicenter in April this year, describing Titan, its peers, and the oligopolistic structure of this market.

In terms of share, different institutions have slightly varying figures: Gattaca's official website states "about 50%," while third-party site rated.network shows 52.04%, approximately 2.8 times that of the second place; another independent monitoring site captured 48.3% in a twenty-four-hour data snapshot on October 26. Regardless of which number is chosen, "close to or exceeding half" is the consensus, and this position has been held since August 2023.

The forms of competitors vary. Once the top share holder, Beaverbuild, now has only 0.13% in the latest independent monitoring; rsync-builder, supported by Coinbase Ventures, focuses on low latency on the East Coast of the United States; BuilderNet, initiated by Flashbots and operated by multiple operators, is the most decentralized, holding about 9.79% of the share.

Most notably is Flashbots. It once produced 60% to 70% of Ethereum's blocks, but now only accounts for 8% to 12%. However, this is not a collapse but a voluntary withdrawal—it has shifted its focus to relays, auction mechanisms for user transaction rights, and cross-chain facilities, effectively abandoning this most lucrative market.

This has created an interesting contrast: both Titan and Flashbots engage in sorting and relaying, but Flashbots chose to build public infrastructure and relinquish market share, while Titan opted to maintain the largest share while also securing access to ninety percent of validators. Both paths are still viable today, but the latter is clearly more profitable.

Its moat is not mysterious. Mensah described a cycle: the better the service, the more transactions queue up; the more transactions, the more valuable the packaged blocks; the more valuable the blocks, the more validators and institutions are willing to collaborate with it. Currently, over half of the transactions on Ethereum do not go through the public waiting area but are sent directly through private channels—whoever has more entry points has more materials. The remaining part is millisecond-level engineering capability, along with a more fundamental element: trust. Bots must entrust their strategies to builders, and if they lose a few times, they will switch to someone else.

It is worth mentioning that Gattaca, which occupies half the market, has initiated an industry organization called Blockspace Forum, specifically discussing "what to do about excessive concentration of block allocation."

Conclusion

In fact, this is the second time Titan Builder has topped the single-day revenue list this year.

The last time was in March: a user incorrectly filled in the slippage parameter, and 50.43 million dollars was distributed across a single block—in twelve seconds—across the entire chain, with Titan taking about 34 million dollars. This time, a trading platform was emptied, and the hacker hurriedly exchanged tokens, with Titan taking 22.83 million dollars.

No one hopes for it to top the list again. But in an industry where the asset scale has already reached trillions and the security boundaries still rely on the blacklist buttons of a few companies, such incidents are unlikely to stop.