Binance was hacked for 6.3 billion USD, yet Titan Builder made a staggering 22.83 million USD in a single day, topping the revenue chart

Author: Gu Yu, ChainCatcher

In the last day, a name that most people have never seen appeared on the DefiLlama protocol revenue leaderboard.

Ranking first is Titan Builder, with a revenue of 22.83 million dollars in the past 24 hours; second is Tether, with 16.99 million dollars; third is Circle, with 6.76 million dollars. It is not a stablecoin company, not an exchange, and not a popular protocol, but a company headquartered in London with only sixteen employees that never publicly promotes itself.

What it does is sort transactions for Ethereum—deciding which transactions to include in each block and in what order. This position has become the most profitable place on the entire chain in the past forty-eight hours.

1. How a Theft Transformed Protocol Revenue

To understand this money, we must first talk about the theft itself.

A large portion of the assets stolen by the hacker was USDT and USDC. These types of assets have a fatal characteristic: the issuer can freeze them. Tether acted the next day, freezing an additional 1.5 billion dollars. Therefore, the hacker had to exchange this money for something that no one could freeze—Ethereum and Tron tokens.

Speed is safety, but speed comes at a price.

From 4:34 AM to 4:49 AM Beijing time on October 30, the hacker used two "sign off-chain first, then have institutions execute" order channels to buy 122,316 ETH with 325 million USDT, at an average transaction price of 2,657 dollars—while the market price at that time was 2,284 dollars. This resulted in an overpayment of 45.7 million dollars. Fifteen minutes later, they bought directly from the on-chain liquidity pool, overpaying another 25.8 million.

In total, buying ETH resulted in an overpayment of 71.5 million dollars. Selling the stolen UNI, PEPE, ENA, LINK, AAVE, and other tokens at a loss resulted in a loss of 24.8 million. Buying TRX on Tron also resulted in an overpayment of 22.4 million. The total amounted to 119 million dollars, all priced within an hour.

This excess money did not disappear into thin air; it was caught by those on the other side of the trade.

In Ethereum's largest ETH/USDT liquidity pool, the price of ETH was once 38% higher than the market. This is an absurd price difference; on a normal night, such opportunities often yield only a few cents of profit. Thus, tens of thousands of wallets rushed in, selling ETH into the high-priced pool and buying the stolen tokens at a low price.

With so many people rushing in, there had to be a queue; to cut in line, one had to pay.

That night, according to blockchain analytics firm Bitquery, the tips paid to block builders by bots amounted to 10,251 ETH. The previous night during the same time period, this number was 4.6 ETH. In one night, it increased by over two thousand times. That same night, there were also 10,235 failed transactions (the previous night had 3,500), each still incurring transaction fees.

The final bill was divided as follows: traders and their bots took away 59.9 million dollars; the company sorting the transactions and the validating nodes took 29.5 million; depositors in the liquidity pool received 20.2 million; and the institutions facilitating the trades received 6.7 million.

It is worth mentioning that those who rushed in did not necessarily profit. Ethereum's most well-known arbitrage bot, jaredfromsubway, seized a discount space worth 2.87 million dollars from that batch of tokens sold at a loss but paid 2.95 million dollars in queue fees, resulting in a net loss of 110,000 dollars. Another wallet seized 3.24 million but paid 3.51 million, resulting in a net loss of 820,000 dollars.

The winner is the one collecting the toll. The total network fees on Ethereum that day jumped from 44.25 million dollars to 56.4 million dollars, reaching a new high since April, while the usual transaction fee is less than a cent.

2. Who is Titan Builder

The parent company of Titan Builder is called Gattaca, founded in London in 2018, originally named Day 0 Dynamics, focusing on proprietary trading. In early 2023, it launched Titan Builder, transforming into infrastructure.

Founder Kubi Mensah is an alumnus of Y Combinator S15, having previously co-founded a mobile security company and successfully exited. Co-founder Philip Gasslander also comes from YC and has worked at Google, while another co-founder, Fabrizio Cavallo Marincola, holds a PhD in computational fluid dynamics from Imperial College. To date, the team consists of only sixteen people, primarily engineers, with a product iteration cycle of two weeks.

One of its key self-positionings is: not engaging in proprietary trading. Mensah repeatedly emphasizes that this is a service business—what they earn is not from their own bets but from the service fees for sorting transactions and guaranteeing "this transaction will be included in this order on the chain" for others. This also explains why their revenue surged this time while being unrelated to the secondary market conditions.

Gattaca currently has five layers deployed on the Ethereum chain, covering the entire process from transaction generation to on-chain inclusion:

• Titan Builder: Responsible for packaging blocks, currently constructing about half of Ethereum's blocks;

• Titan Relay: Responsible for delivering blocks to validating nodes, connecting over 90% of Ethereum's validators;

• Nova: A one-stop transaction execution and anti-frontrunning service for ordinary users and wallets;

• Kairos: Securing "priority lanes" on Arbitrum, holding about 70% of the time;

• Based OP: An open-source sorter provided for Optimism.

It is necessary to clarify the difference between "builders" and "relays." Builders are the ones who decide the order of transactions; validators are randomly selected and ultimately add the block to the chain. The two do not trust each other, requiring a guarantor in between—the relay. When Bitquery tracked the flow of funds that night, it found that most of the money paid to validators went through Titan's payment relay.

It simultaneously holds both "sorting rights" and "the access pipeline for 90% of validators," and this dual identity explains why it is the biggest beneficiary in this incident. DefiLlama's records show that Titan's revenue in normal months ranges from 3 million to 10 million dollars.

3. Half of Ethereum and the Changes Around It

Three builders control the vast majority of Ethereum's blocks—this was the title of an episode of the podcast Epicenter in April this year, describing Titan, its peers, and the oligopolistic structure of this market.

In terms of share, different institutions have slightly different figures: Gattaca's official website states "about 50%," while third-party site rated.network shows 52.04%, approximately 2.8 times that of the second place; another independent monitoring site captured 48.3% in a 24-hour data snapshot on October 26. Regardless of which number is chosen, "close to or exceeding half" is the consensus, and this position has been held since August 2023.

The forms of competitors vary. The former share leader Beaverbuild now only holds 0.13% in the latest independent monitoring; rsync-builder, supported by Coinbase Ventures, focuses on low latency on the US East Coast; BuilderNet, initiated by Flashbots and operated by multiple operators, is the most decentralized, holding about 9.79% of the share.

Most notably is Flashbots. It once produced 60% to 70% of Ethereum's blocks, but now only accounts for 8% to 12%. However, this is not due to being crushed but rather a voluntary retreat—it has shifted its focus to relays, auction mechanisms for user transaction rights, and cross-chain facilities, effectively abandoning this most lucrative market.

This has created an interesting contrast: both Titan and Flashbots engage in sorting and relaying, but Flashbots chose to focus on public infrastructure and relinquish market share, while Titan opted to maintain the largest share while also controlling access to 90% of validators. Both paths are still viable today, but the latter is clearly more profitable.

Its moat is not mysterious. Mensah described a cycle: the better the service, the more transactions queue up; the more transactions, the more valuable the packaged blocks; the more valuable the blocks, the more validators and institutions are willing to cooperate with it. Currently, over half of the transactions on Ethereum do not even go through the public waiting area, being sent directly through private channels—whoever has more entry points has more materials. The remaining part is millisecond-level engineering capability, along with a more fundamental element: trust. Bots need to entrust their strategies to builders; if they lose a few times, they will switch to someone else.

It is worth mentioning that Gattaca, which occupies half the market, has initiated an industry organization called Blockspace Forum, specifically discussing "what to do about excessive concentration of block allocation."

Conclusion

In fact, this is Titan Builder's second time topping the daily revenue leaderboard this year.

The last time was in March: a user filled in the slippage parameter incorrectly, and 50.43 million dollars were distributed across one block—within twelve seconds—resulting in Titan taking about 34 million dollars. This time, it was a hack where an exchange was emptied in a hurry, and it took away 22.83 million dollars.

No one hopes to see it top the list again. But in an industry with asset scales already in the trillions, where safety boundaries still rely on the blacklist buttons of a few companies, such incidents are unlikely to stop.