To dump stolen coins before the freezes, the attacker bought ETH at up to 32% above Binance and sold dozens of altcoins at deep discounts. On Uniswap, ETH hit $3,487 while Binance showed $2,266. Every dollar of that gap landed in someone's pocket.

Block builders took the most. In the hour from 20:30 UTC, Ethereum builders and validators collected about 7,200 ETH (~$16.5M) in tips. The same hour a day earlier paid 4.55 ETH. Titan built 191 of 298 blocks, and beaverbuild got 1,070 ETH (~$2.4M) from a single transaction.

Arbitrage bots came second, with about $12.7M for the top 10. The best one borrowed 11,701 ETH on Aave, sold it on-chain near $2,595 and bought it back near $2,221, clearing about $4.4M. Another wallet pulled 4,175 ETH from Kraken and sold it on-chain 72 seconds later for $11.24M, about $1.8M above the Binance price.

Market makers got far less than you'd think. The hacker sold 325M USDT for ETH through UniswapX and 1inch Fusion at an average of $2,657. Most fillers bought that ETH on Uniswap in the same transaction, so the spread leaked to pools, arbs and builders. The biggest filler, registered on 1inch as Kipseli, handled 145M USDT, kept about 149 ETH (~$337K) and paid builders 1,221 ETH. One resolver did it differently: it posted 28.6M of the stolen USDT as collateral on Compound, borrowed 10,041 ETH and now sits on about $6M. That USDT is still there.

Bots cleaned up the altcoin dump, about $9.4M for the top three. jaredfromsubway sandwiched 25 of the hacker's 29 ONDO sales. UNI went for $5.69 vs $6.41 on Binance.

On Tron the attacker swapped 234M USDT into TRX at $0.367 while Binance showed $0.334, about $21M handed to arbitrageurs. Uniswap LPs earned about $2.2M in fees, 130x a normal hour.

The window stayed open for about 45 minutes, and anyone could trade it: buy ETH on a centralized exchange, sell it on-chain for 10%+ more. The catch was having money outside Binance, where withdrawals were frozen.