The Binance hacker lost $119M to bad prices while cashing out. Traders kept $60M. Block builders and validators took $30M

01 · What happenedWho made money from the Binance hack

The Binance hacker had a problem. Much of the haul was in digital dollars that their issuer could freeze. So on the night of 29 October, the hacker raced to swap them for ETH and TRX. Speed cost money.

Every rushed trade paid well over the going price, and every stolen token sold went for less than it was worth. Add up the night and the hacker lost $119 million against market prices. Each of those dollars landed with someone on the other side of a trade.

Bitquery records every trade on Ethereum and TRON, so we followed that money to where it ended up. Trading firms and their bots kept $59.9M after their costs. The builders and validators who put Ethereum's blocks together took $29.5M, paid to them by the same bots racing to trade first. We could not trace about 4%. Our trace of the Binance hack covers the theft itself: how $6.3 billion left Binance and where it sits.

02 · The setupWhy a hurried trader pays everyone else

Most crypto swaps on Ethereum happen in pools. A pool is a pot of two coins run by code, and the price comes from the mix inside the pot. A large buy takes one coin out, so its price in that pool rises with each trade.

When one pool's price drifts away from the rest of the market, arbitrage bots move in. They buy ETH where it is cheap and sell it into the pool where it is dear, until the two prices meet again. Traders call this crypto arbitrage, and on a normal night the gaps are tiny. Our piece on arbitrage that makes 69 cents a trade shows how thin they usually are.

Bots compete for the same gap, so they pay to go first. On Ethereum they tip the block builder, the firm that orders transactions into each block. The builder passes most of it on to the validator who adds the block to the chain. Traders call this race MEV, short for maximal extractable value.

The hacker also used two order apps, UniswapX and 1inch Fusion. On both, you sign an order and a trading firm fills it from its own stock or from pools. UniswapX calls these firms fillers; 1inch calls them resolvers. Our study of CoW Swap's solver auctions explains how firms compete for such orders.

03 · The lossesWhere the hacker lost $119M

Buying ETH cost the most. The hacker swapped stolen USDT for ETH through the two order apps and then straight from pools, and paid $71.5M more than the coins were worth on the open market. Selling stolen tokens such as UNI, PEPE and ENA below their market price cost another $24.8M. Buying TRX on TRON cost $22.4M.

These are losses against a fair price, measured trade by trade. The hacker still holds the ETH and TRX it bought. It got fewer coins, or fewer dollars, than an unhurried trader would have. Another 56 small tokens had no reliable market price to compare with; against their price before the hack, the hacker gave up about $9–16M on those, which is not in the total.

04 · The winnersWho ended up with the money

Half of it went to traders. Most were arbitrage bots that sold ETH and TRX back into the overpriced pools or bought the dumped tokens cheap, and some were large holders who sold at the right moment. Their $59.9M is what they kept after paying gas and builder tips.

A quarter went to Ethereum's block builders and validators: bots paid them $29.5M in tips and fees to have their trades placed first.

Liquidity providers, the people who deposit the coins a pool trades, booked $20.2M at the prices of the moment. Most of the TRON share came from TRX's market price rising toward the pool price later in the night. Against simply holding their coins, TRON's liquidity providers were ahead by only $0.74M by morning. The fillers and resolvers that took the hacker's first orders kept $6.7M.

05 · EthereumOn Ethereum, ETH sold at a 38% markup

The hacker started with the order apps and paid a 16% markup on them. Fillers and resolvers took the stolen dollars and delivered ETH at prices well above the open market.

The fillers bought much of that ETH from pools, which pushed pool prices up. Then the hacker's own wallets bought from the pools too, and two of them alone overpaid by $21.9M. In Uniswap's main WETH/USDT pool, the minute-average price of ETH peaked 38% above the market.

The gap drew in arbitrage bots from all over Ethereum. Thousands of wallets sold ETH into the high pools before the gap closed, and they kept $40.7M after gas and builder tips. Bots took $28.7M of that. The rest went to wallets that traded a few times or once, and some of them sold thousands of ETH in a single trade.

None of the top wallets carries a firm name in address labels. The largest, 0x0cdd…61d8, made $3.46M in 26 trades and paid no builder tips at all. CoW Protocol's settlement contract shows up too: it carried $1.27M of gains for users who swapped through CoW Swap that night.

Most of the fillers' $6.7M came from a single order. One 1inch resolver paid for its ETH with a loan from Compound instead of buying from pools, and kept about $6.1M. The fillers that bought from pools passed most of their margin to the pools and to block builders.

06 · The MEV raceMEV bots paid Ethereum's block builders 10,251 ETH

On the night before the hack, bots sent Ethereum's block builders 4.6 ETH in tips over the same four and a half hours. On the hack night they sent 10,251 ETH. Every bot wanted to be first to the gap, and the only way to jump the queue was to pay more than the next bot.

The builders kept little of it, about 564 ETH. They paid the rest on to the validators who proposed their blocks, mostly through Titan's payment relay. Validators run by staking pools such as Lido share that income with their stakers. Failed attempts cost money too: 10,235 transactions failed that night, against 3,500 the night before, and each one still paid gas. Our look at why Ethereum staking yields halved explains how this kind of income reaches stakers.

07 · TRONOn TRON, the pool stayed high all night

On TRON, the hacker swapped 234 million USDT for TRX on SunSwap and paid well over the market for every coin. SunSwap's main TRX pool jumped to 18% above the market, and the gap never fully closed.

Traders who sold TRX into the pools made $12.4M before fees. The top wallet, which trades through the contract TS5v9Z…NZC7, made $1.11M by buying TRX in one pool and selling it in another within the same transactions.

The pool's liquidity providers look like big winners at first sight, at $10.4M. Most of that came from TRX's market price rising about 9% toward the pool price later in the night. Against simply holding their coins, they were up $0.74M by morning.

The hacker has started selling. Early on 30 October, 15 new wallets funded through the hacker's TRON addresses sold 8.9 million TRX for $3.1M of USDT, into pools that were still slightly above the market. The largest TRX stash had not moved. The full TRON history is also sold as files: the TRON dataset on the Bitquery Data Store.

08 · Token dumpsDumping stolen tokens cost the hacker $24.8M

Later that night, the hacker's wallets began selling the other tokens taken from Binance: UNI, PEPE, ENA, LINK, AAVE and dozens more. On the tokens with a reliable market price, the hacker received $208M, which was $24.8M less than the coins were worth at the time.

The worst sale, as a share of value, was USDe, Ethena's dollar token. The hacker sold it into a small pool and took a 30% haircut, about $2.90M. Our report on the USDe loop unwind covers how that token usually trades.

Who caught the discount? On the biggest tokens, block builders took 49% through bot tips and priority fees. Bots kept $4.9M and liquidity providers $5.1M. Some of the best-known bots spent more than they made.

Address labels mark 0xae2f…ae13 as jaredfromsubway, one of Ethereum's best-known MEV bots. It caught one of the biggest shares of the dumped tokens' discount, then paid even more than that to block builders as priority fees. It ended the night slightly down on these trades. A contract labelled as Wintermute's, the market-making firm in our Coinbase tokenized stocks piece, kept a small gain.

09 · RLUSDRLUSD broke for ten minutes

The hacker also sold 48 million RLUSD, Ripple's dollar token, over about twenty minutes that evening. The price slipped, and one trade printed as low as $0.81. Within minutes it was back near a dollar.

Because most of the sale filled close to a dollar, the hacker lost only $263K on it. Traders who bought the dip made $232K before costs. Our earlier look at RLUSD on the XRP Ledger covers the token's other home.

10 · Still at stakeWhat the hacker can still take out of Aave

Before the freezes, the hacker deposited 60 million USDT into Aave, a lending app, and borrowed ETH against it. Tether cannot freeze that USDT, because Aave holds it, and Aave's deposit freeze does not stop withdrawals. Our audit of Tether's blacklist explains how those freezes work.

What stops the hacker now is cash. Other lenders pulled their USDT out of Aave that night, and by the morning of 30 October Aave's USDT pool held only $4,707. A test withdrawal from the hacker's account to a fresh address works up to about $3,185. If lenders put USDT back, the hacker could take out up to $3.6M before its loan's safety limit stops it.

11 · The methodHow we measured it

We compared every trade with the price on Hyperliquid, a large crypto exchange, in the same minute. Dollar tokens count at one dollar. A trade above that price is the buyer's loss and the seller's gain. We added up each wallet's trades over the night, then took off what it paid in gas and in tips to block builders, counting each cost once.

Four separate ledgers cover the ETH buys, the TRON buys, the token dumps and the RLUSD sale. A separate checker rebuilt each one from different data and found errors we then fixed. The $4.5M we could not trace is mostly ETH bought through tokens we did not measure, and 21 small tokens whose discount we did not split. The trades come from Bitquery's Ethereum dataset.

12 · The recordThe addresses behind these findings

FAQ

Who profited from the Binance hack?

Traders and their bots made the most. While the hacker swapped stolen coins in a hurry, they sold to it at high prices and bought its tokens cheap, and kept about $60M after costs. Ethereum's block builders and validators took about $30M in tips and fees from the same bots.

How much did the Binance hacker lose by swapping?

About $119M against market prices. Most of it came from overpaying for ETH on Ethereum. The rest came from selling stolen tokens cheap, overpaying for TRX on TRON and a small loss on RLUSD.

What is an MEV bot?

An MEV bot is a trading program that hunts for price gaps and other chances to profit from the order of transactions in a block. MEV stands for maximal extractable value. Bots pay block builders to put their trades first.

What is a block builder?

A block builder is a firm that collects transactions and orders them into an Ethereum block. Bots pay builders tips to be placed first, and builders pay most of that on to the validator who adds the block to the chain.

Can the Binance hacker still withdraw money from Aave?

Only a little for now. The hacker's USDT deposit on Aave is still unfrozen. On the morning of 30 October, though, Aave's USDT pool was nearly empty, so a withdrawal worked only up to about $3,185. If lenders return, the hacker could withdraw up to $3.6M.

Why did ETH cost more on Uniswap during the Binance hack?

The hacker bought so much ETH so fast that it pushed up the price in the biggest Uniswap pools. ETH there rose to 38% above the rest of the market and stayed above it for hours while bots sold ETH back in.