Author: Gu Yu, ChainCatcher
In the past day, a name most people have never seen appeared on DefiLlama's protocol revenue leaderboard.
Ranked first is Titan Builder, with revenue of $22.83 million in the last 24 hours; second is Tether, $16.99 million; third is Circle, $6.76 million. It is not a stablecoin company, not an exchange, nor a popular protocol, but a company headquartered in London with only sixteen employees that never publicly promotes itself.
What it does is order Ethereum transactions—deciding which transactions go into each block and in what order. This position has become the most profitable place on the entire chain in the past forty-eight hours.
1. How a theft case turned into protocol revenue
To understand this money, we must start with the theft itself.
A large portion of the assets stolen by the hacker were USDT and USDC. Such assets have a fatal characteristic: the issuer can freeze them. Tether acted the next day, adding over $1.5 billion to the freeze. So the hacker had to convert this money into something no one could freeze—Ethereum and Tron tokens.
Speed is safety, but speed has a price.
From 4:34 to 4:49 AM Beijing time on October 30, the hacker used two order channels—"sign off-chain first, then have an institution execute the trade"—to buy 122,316 ETH with 325 million USDT, at an average price of $2,657—while the market price at the time was $2,284. On this trade alone, it overpaid $45.7 million. Fifteen minutes later, it bought directly from on-chain liquidity pools, overpaying another $25.8 million.
In total, it overpaid $71.5 million for ETH. It sold stolen UNI, PEPE, ENA, LINK, AAVE and other tokens at a loss of $24.8 million. Buying TRX on Tron cost another $22.4 million. The total was $119 million, all priced within one hour.
This overpaid money did not disappear into thin air; it was caught by those on the other side of the trades.
In Ethereum's largest ETH/USDT pool, the price of ETH was once 38% higher than the market. This was an absurd spread; on a normal night, such opportunities often yield only a few cents in profit. So thousands of wallets rushed in, selling ETH into the high-priced pool and buying the stolen tokens at low prices.
When many people compete, they must queue; to cut in line, they must pay.
On this night, according to blockchain analytics firm Bitquery, bots paid block builders 10,251 ETH in tips. On the same period the previous night, this number was 4.6 ETH. Overnight, more than two thousand times. On the same night, there were also 10,235 failed transactions (3,500 the previous night), each still paying fees.
The final bill was split as follows: traders and their bots took $59.9 million; the companies ordering transactions and validators took $29.5 million; liquidity pool depositors $20.2 million; institutions helping match trades $6.7 million.
It is worth noting that those who rushed in did not necessarily profit. Ethereum's most well-known arbitrage bot, jaredfromsubway, captured $2.87 million in discount value from the dumped tokens, but paid $2.95 million in priority fees, resulting in a net loss of $110,000. Another wallet captured $3.24 million but paid $3.51 million, a net loss of $820,000.
The winner is the one collecting tolls. Ethereum's total network fees that day jumped from $44.25 million to $56.4 million, a new high since April, while normally a transaction fee is less than one cent.
2. Who is Titan Builder
Titan Builder's parent company is called Gattaca, founded in London in 2018, originally named Day 0 Dynamics, doing proprietary trading. In early 2023, it launched Titan Builder and pivoted to infrastructure.
Founder Kubi Mensah is a Y Combinator S15 batch alumnus and previously co-founded and successfully exited a mobile security company. Co-founder Philip Gasslander also comes from YC and once worked at Google, and another co-founder Fabrizio Cavallo Marincola is a PhD in computational fluid dynamics from Imperial College. To date, the team has only sixteen people, mostly engineers, with a two-week product iteration cycle.
Its most critical self-positioning is: no proprietary trading. Mensah repeatedly emphasizes that this is a service business—what it earns is not money from its own bets, but service fees for ordering transactions for others and guaranteeing for others that "this transaction will be on-chain in this order." This also explains why its revenue surge this time has nothing to do with the market: it did not buy a single ETH from beginning to end.
Gattaca currently has five layers on the Ethereum chain, covering the entire process of a transaction from generation to on-chain:
Titan Builder: responsible for bundling blocks; currently about half of Ethereum's blocks are built by it;
Titan Relay: responsible for delivering blocks to validators, connected to over 90% of Ethereum validators;
Nova: a one-stop transaction execution and anti-sandwich service for ordinary users and wallets;
Kairos: seizes the "priority channel" on Arbitrum, holding it about 70% of the time;
Based OP: an open-source sequencer provided for Optimism.
It is necessary to clarify the difference between "builder" and "relay." A builder is the one deciding transaction order; a validator is the one randomly selected to ultimately add the block to the chain. The two do not trust each other, and a guarantor is needed in between—a relay. When Bitquery tracked the flow of funds that night, it found that most of the money paid to validators went through Titan's payment relay.
It simultaneously holds "ordering power" and "the access pipeline to ninety percent of validators." These two identities叠加 explain why it is the biggest beneficiary of this incident. DefiLlama records show that in normal months Titan's revenue ranges between $3 million and $10 million.
3. Half of Ethereum, and the changes around it
Three builders control the vast majority of Ethereum blocks—this was the title of an episode of the podcast Epicenter in April this year, describing Titan, its peers, and the oligopolistic structure of this market.
In terms of share, different institutions have slightly different figures: Gattaca's official website says "about 50%," third-party site rated.network shows 52.04%, about 2.8 times the second place; another independent monitoring site captured 48.3% in 24-hour data on October 26. Whichever number is taken, "close to or over half" is the consensus, and it has held this position for three years since August 2023.
Competitors come in different forms. Former share leader Beaverbuild now has only 0.13% in the latest independent monitoring; rsync-builder is backed by Coinbase Ventures and focuses on low latency on the U.S. East Coast; BuilderNet, initiated by Flashbots and jointly run by multiple operators, is the most decentralized, with about 9.79% share.
The most noteworthy is Flashbots. It once produced 60-70% of Ethereum blocks, now only 8% to 12%. But this is not being defeated, but a proactive retreat—it shifted focus to public layers such as relays, auction mechanisms for users' transaction rights, and cross-chain infrastructure, effectively abandoning this most lucrative market.
Thus an interesting contrast formed: both have ordering and relay businesses, Flashbots chose to build public infrastructure and give up share, while Titan chose to hold the largest share and tightly grip access to ninety percent of validators. Both paths are still alive, but the latter is clearly more profitable.
Its moat is not mysterious. Mensah described a cycle: the better the service, the more transactions come to queue; the more transactions, the more valuable the blocks built; the more valuable the blocks, the more validators and institutions are willing to cooperate with it. And now more than half of Ethereum transactions do not go through the public waiting area at all, but are sent directly through private channels—whoever has more entrances has more material. The rest is millisecond-level engineering capability and something more plain: trust. Bots must hand their strategies to builders, and if they lose a few times, they will switch.
It is worth mentioning that Gattaca, which occupies half the market, itself initiated an industry organization called Blockspace Forum, specifically to discuss "what to do about excessive concentration of block allocation."
Conclusion
In fact, this is the second time this year that Titan Builder has topped the single-day revenue rankings.
The last time was in March: a person entered the slippage parameter incorrectly, and $50.43 million was split across the entire chain in a single block—twelve seconds—and it took about $34 million. This time, an exchange was drained, and the hacker, in a panic, swapped tokens, and it took $22.83 million.
Between the two times, not once did it do anything right itself. It just happened to be standing in the same position in both periods of chaos.
A company of sixteen people, in three years, has captured the block-building rights for half of Ethereum's blocks and connected to more than ninety percent of validators. Its founder says this is purely a service business. That is true—it is just that the price of this service does not depend on how well it performs, but on how panicked this chain is.
And among its four collapse-style revenue peaks, two came from other people's disasters.
