Binance Breach Trades Send an Estimated $29.5M to Ethereum Builders and Validators

Ethereum block builders and validators received an estimated combined $29.5 million as wallets tied to Binance’s Oct. 29 breach traded stolen assets, while the wallets’ trading shortfall reached about $119 million.

From 4:30 p.m. ET Oct. 29 to 9 p.m. ET (20:30 UTC Oct. 29 to 01:00 UTC Oct. 30), bots paid builders 10,251 Ether (ETH) in tips. The same four-and-a-half-hour period the prior night brought 4.6 ETH in tips. Builders retained about 564 ETH and passed most of the remaining tips to validators, largely through Titan’s payment relay. Traders and bots kept about $59.9 million after gas and builder tips; the $29.5 million estimate covers builders and validators together.

At 5:09 p.m. ET (21:09 UTC) Oct. 29, the one-minute average price in Uniswap’s main Wrapped Ether/Tether (WETH/USDT) pool was 38% above Hyperliquid’s price for that minute.

The $119 million estimate compares trades with same-minute Hyperliquid prices. ETH purchases above market accounted for $71.5 million, TRON (TRX) purchases for $22.4 million, and sales of stolen tokens below market for $24.8 million. Those three main components total $118.7 million, consistent with an overall estimate of about $119 million. The TRX and token-sale comparisons use futures prices, which can differ from spot prices. The estimate measures execution gaps against price benchmarks, not confirmed realized losses or recovered funds.

The estimate excludes 56 smaller tokens without reliable market prices. Their estimated shortfall against pre-breach prices was $9 million to $16 million. The Ethereum trading window ran through 9 p.m. ET Oct. 29, while TRX purchases and token sales continued until 3 a.m. ET Oct. 30. Ethereum logged 10,235 failed transactions during the measured period, compared with about 3,500 in the same hours the previous night.

Maximal extractable value, or MEV, is value captured by determining which transactions enter a block and in what order. Builders assemble and order transactions into blocks; validators propose those blocks and can receive bids from builders.

Binance said its hot wallets were compromised at 4:05 p.m. ET Oct. 29 (20:05 UTC), in the incident detailed in Binance’s initial estimate of the breach’s impact. In a Nov. 1 status update, Binance listed withdrawals as available for Bitcoin (BTC); Ether, Tether (USDT) and USD Coin (USDC) on Ethereum; BNB and the two stablecoins on BNB Smart Chain; XRP; and Ether and USD Coin on Base. The update said more routes would follow after security checks.