On October 29 the Binance hacker drained the exchange's hot wallets at 20:24 UTC and started a race against the freezes. Stolen USDT can be blocked by Tether at any moment, ETH cannot. So between 20:34 and 20:49 UTC the hacker sold 325M USDT in 9 orders through UniswapX and 1inch Fusion and got 122,316 ETH, at an average of $2,657. Binance was trading near $2,300. The last order went through 8 minutes before the first freeze of the night. Speed cost the hacker about $45M on this one swap.

ETH at $3,487, for one block

At 21:09 UTC, ETH in Uniswap's main ETH/USDT pool hit $3,487 while Binance showed $2,266. In the same block, USDT itself traded at $0.798 against USDC on Uniswap. Part of the spike was USDT breaking down, not ETH flying: in USDC pools ETH peaked around $2,780. Either way, the on-chain premium stayed above 10% for about 45 minutes.

Who got the money

• Block builders and validators: ~7,200 ETH (~$16.5M). That is what they collected in tips in the hour from 20:30 UTC. The same hour a day earlier paid 4.55 ETH. Titan built 191 of the 298 blocks, and a single transaction paid beaverbuild 1,070 ETH (~$2.4M).
• Arbitrage bots. The best one borrowed 11,701 ETH on Aave in 18 loans, sold it on-chain near $2,595 and bought it back near $2,221, clearing about $4.4M. Another wallet pulled 4,175 ETH from Kraken and sold it on-chain 72 seconds later for $11.24M, about $1.8M above the Binance price.
• A 1inch resolver that kept the stolen USDT. Instead of buying ETH on the market, it posted 28.6M of the hacker's USDT as collateral on Compound, borrowed 10,041 ETH and handed the hacker 9,566. The position is still open, worth about $6M, and the stolen USDT is still sitting there.
• The biggest filler, with the smallest cut. A resolver registered on 1inch as Kipseli handled 145M USDT, 45% of the volume. It kept about 149 ETH (~$337K) and paid builders 1,221 ETH, eight times more.

Then came the altcoins

After ETH, the hacker dumped dozens of tokens at a discount, and the bots were waiting. jaredfromsubway sandwiched about 25 of the hacker's 29 ONDO sales. 7M UNI went for an average of $5.69 while Binance showed $6.41. On Tron the attacker swapped 234M USDT into TRX at $0.367 against $0.334 on Binance, another ~$21M given away. Across all legs, our on-chain estimate puts the hacker's total overpayment at about $90M.

Why market makers did not take it all

The trade was open to anyone: buy ETH on a centralized exchange, sell it on-chain for 10% more. The catch was having ETH outside Binance, where withdrawals were frozen, and beating bots that hand most of the spread to builders just to land first. Most fillers bought the hacker's ETH on Uniswap in the same transaction, so the spread leaked to pools, arbitrageurs and block builders.

Every dollar the hacker paid for speed ended up with someone who was faster.

Figures are on-chain estimates against Binance prices in the same minute. Builder tips are paid out of the arbitrage spreads, so the groups overlap. Sources: Ethereum and Tron on-chain data, Binance 1-minute prices, TRM Labs.