727 FinanceAuthor: Gu Yu, ChainCatcher
In the past day, a name most people have never seen has appeared on DefiLlama's protocol revenue leaderboard.
Ranked first is Titan Builder, with revenue of $22.83 million in the past 24 hours; second is Tether, with $16.99 million; third is Circle, with $6.76 million. It is not a stablecoin company, not an exchange, and not some popular protocol, but a London-headquartered company with only sixteen employees that never publicly promotes itself.
What it does is order Ethereum transactions—deciding which transactions go into each block and in what order. Over the past forty-eight hours, this position has become the most profitable place on the entire chain.
I. How a theft case was converted into protocol revenue
To understand this money, we must start with the theft itself.
A large portion of the assets stolen by the hacker were USDT and USDC. This type of asset has a fatal characteristic: the issuer can freeze it. Tether acted the next day, increasing the frozen amount to more than $1.5 billion. So the hacker had to convert this money into something no one could freeze—Ethereum and Tron tokens.
Speed is safety, but speed has a price.
From 4:34 a.m. to 4:49 a.m. Beijing time on October 30, through two order channels that "first sign off-chain, then have an institution execute the trade on their behalf," the hacker used 325 million USDT to buy 122,316 ETH at an average execution price of $2,657—while the market price at the time was $2,284. On this single trade, the hacker overpaid $45.7 million. Fifteen minutes later, it bought directly from an on-chain liquidity pool and overpaid another $25.8 million.
In total, it overpaid $71.5 million to buy ETH. It sold stolen tokens such as UNI, PEPE, ENA, LINK, and AAVE at a loss of $24.8 million. It bought TRX on Tron and overpaid another $22.4 million. The total was $119 million, all priced within one hour.
This overpaid money did not disappear into thin air; it was captured by the people on the other side of the trades.
In Ethereum's largest ETH/USDT liquidity pool, the price of ETH at one point was 38% higher than the market. That was an absurd spread; on a normal night, such an opportunity often yields only a few cents in profit. So thousands of wallets rushed in, selling ETH into the high-priced pool and buying the stolen tokens at low prices.
The more people rushed in, the more they had to queue; to jump the queue, they had to pay.
That night, according to blockchain analytics firm Bitquery, bots paid block builders 10,251 ETH in tips. On the previous night during the same period, that number was 4.6 ETH. Overnight, more than two thousand times. That same night, there were also 10,235 failed transactions (3,500 the previous night), and each one still paid fees.
The final bill was split as follows: traders and their bots took $59.9 million; the companies that ordered transactions and the validators took $29.5 million; liquidity pool depositors took $20.2 million; the institutions that helped match trades took $6.7 million.
It is worth noting that the front-runners did not necessarily profit. Ethereum's best-known arbitrage bot, jaredfromsubway, captured $2.87 million in discount value from the batch of tokens sold at low prices, but paid $2.95 million in priority fees for it, resulting in a net loss of $110,000. Another wallet captured $3.24 million and paid $3.51 million, a net loss of $820,000.
The winner was the one collecting tolls. Ethereum's total network fees that day jumped from $44.25 million to $56.4 million, a new high since April, while on a normal day the fee for a transaction is less than one cent.
II. Who is Titan Builder
Titan Builder's parent company is called Gattaca, founded in London in 2018 and originally named Day 0 Dynamics, doing proprietary trading. In early 2023, it launched Titan Builder and pivoted to infrastructure.
Founder Kubi Mensah is a Y Combinator S15 alumnus and previously co-founded and successfully exited a mobile security company. Co-founder Philip Gasslander also comes from YC and once worked at Google, and another co-founder, Fabrizio Cavallo Marincola, holds a PhD in computational fluid dynamics from Imperial College. To date the team has only sixteen people, mostly engineers, with a two-week product iteration cycle.
One of its most critical self-positionings is: it does not do proprietary trading. Mensah has repeatedly emphasized that this is a service business—what it earns is not money from its own bets, but service fees for ordering transactions on behalf of others and guaranteeing for others that "this transaction will be included on-chain in this order." This also explains why its revenue soared this time without being related to the market: it did not buy a single ETH from beginning to end.
Gattaca currently has five layers on the Ethereum chain, covering the entire process of a transaction from creation to inclusion on-chain:
Titan Builder: responsible for assembling blocks; currently about half of Ethereum's blocks are built by it;
Titan Relay: responsible for delivering blocks to validators, connecting more than 90% of Ethereum's validators;
Nova: a one-stop transaction execution and MEV-protection service for ordinary users and wallets;
Kairos: seizes the "priority channel" on Arbitrum, holding it about 70% of the time;
Based OP: an open-source sequencer provided for Optimism.
Here it is necessary to clarify the difference between a "builder" and a "relay." A builder is the one that determines transaction order; a validator is the one randomly selected to ultimately add the block to the chain. The two do not trust each other, and a guarantor is needed in between—a relay. When Bitquery tracked the flow of funds that night, it found that most of the money paid to validators went through Titan's payment relay.
It simultaneously holds "ordering power" and the "access pipeline to ninety percent of validators." The combination of these two identities explains why it was the biggest beneficiary of this incident. DefiLlama records show that in normal months Titan's revenue ranges from $3 million to $10 million.
III. Half of Ethereum, and the changes around it
Three builders control the vast majority of Ethereum blocks—this was the title of an episode of the podcast Epicenter in April this year, describing precisely Titan, its peers, and the oligopolistic structure of this market.
On share, different institutions have slightly different figures: Gattaca's official website says "about 50%," the third-party site rated.network shows 52.04%, about 2.8 times that of the second place; another independent monitoring site captured 24-hour data of 48.3% on October 26. Whichever number is taken, "close to or more than half" is the consensus, and it has held this position for three years since August 2023.
Its competitors have different forms. Former share leader Beaverbuild has only 0.13% left in the latest independent monitoring; rsync-builder is backed by Coinbase Ventures and focuses on low latency on the U.S. East Coast; BuilderNet, initiated by Flashbots and jointly run by multiple operators, is the most decentralized one, with about 9.79% share.
The most noteworthy is Flashbots. It once produced 60% to 70% of Ethereum's blocks, and now has only 8% to 12% left. But this was not a defeat; it was a voluntary retreat—it shifted its focus to public layers such as relays, auction mechanisms for users' transaction rights, and cross-chain infrastructure, effectively abandoning this fattest market.
Thus an interesting contrast has formed: with the same two businesses of ordering and relaying, Flashbots chose to build public infrastructure and give up share, while Titan chose to both hold the largest share and tightly grasp access to ninety percent of validators. Both paths are still alive today, but the latter is clearly more profitable.Its moat is no mystery. Mensah once described a cycle: the better the service, the more transactions queue up; the more transactions, the more valuable the blocks that get packaged; and the more valuable the blocks, the more validators and institutions are willing to work with it. Yet today more than half of all transactions on Ethereum never pass through the public waiting area at all—they are routed in directly through private channels. Whoever holds more entry points holds more material. The rest is millisecond-level engineering capability, plus something more mundane: trust. Bots must hand their strategies to builders, and after a few losing runs they switch to someone else.
Worth noting: Gattaca, which holds half the market, has itself launched an industry organization called the Blockspace Forum, dedicated to discussing "what to do about excessive concentration of block allocation."
Conclusion
In fact, this is the second time this year that Titan Builder has topped the single-day revenue ranking.
The last time was in March: one person entered a slippage parameter incorrectly, and $50.43 million was split across the entire chain within a single block—twelve seconds—with Titan taking about $34 million. This time an exchange was drained, and the hacker, scrambling to swap tokens, handed it $22.83 million.
Between the two occasions, not once did it do anything right itself. It simply happened to be standing in the same position amid two episodes of chaos.
A sixteen-person company, in three years, has captured the packaging rights for half of Ethereum's blocks and connected to more than ninety percent of validators. Its founder says this is purely a service business. That is true—except the price of this service does not depend on how well it performs, but on how panicked the chain is.
And of its four collapse-style revenue peaks, two came from other people's disasters.