After the $6.3B Binance Hack: How On-Chain Bots Cashed In, One Netted 1,205 ETH

The hacker and RFQ solvers bought ETH on DEXs in size, pushing the main pools 17–38% above CEX prices. Selling ETH into those pools earned "DEX price − CEX price" per ETH; hedging on a CEX, or buying back once the premium faded, locked it in.

Top five addresses:

The biggest bot, 0x51c728…502a7f, sent 235 transactions from 69 addresses and sold 22,757 ETH at an average of 2,431 while Chainlink sat at 2,273. It netted 866.5 ETH and paid another 746.1 ETH in tips to buy the front of the block. Large holders selling their own ETH through aggregators paid almost no tip. The premium decayed fast: the last sale captured only about 4.8%.

The 9,845 ETH for this group is a paper gain, marked against the CEX price at the time of sale (as if each seller hedged on a CEX); it isn't realized profit.

Aave prices loans with Chainlink, which tracks CEXs; DEXs were 17–38% higher. Borrow ETH at the CEX price, sell at the DEX price, deposit the stablecoins as collateral, borrow again.

The top looper, 0x0cdd9c…e661d8, ran 18 rounds between 04:50 and 05:32: borrow ETH, sell through 0x ($2,390–2,738), deposit USDC. After the freeze it bought back 12,313 ETH with $2,290/$2,300 limit orders filled by CoW and 0x solvers, then repaid. Average sell $2,580, buy-back $2,298, flat on ETH: about $3.43M realized in roughly two hours.

At 05:47 Aave governance froze the market and set LTV to 0, ending the loop. Funding was never the bottleneck: Aave utilization only rose from 79% to 82%.

The hacker dumped stolen altcoins (PHA, ENS, and others) through the Uniswap V3 Router into one pool at a time. That pool's price dropped; the same token in other pools (V2, other fee tiers) stayed at the old price. A bot landing right after bought low and sold high in one transaction: no front-running, no directional risk.

From 09:17 to 11:32 the hacker dumped more than 30 tokens from the main wallet. The most frequent were OGN (99 sells), RED, CVX, IMX, AXS, CRV and CFG, plus PHA, ENS, YFI, APE and others. Backrun bots traded these altcoins: each transaction buys and sells the same token and closes back into WETH, so profits are in ETH. The five most profitable backruns traded PHA, CFG/RED, ENS (twice) and YFI.

The top backrun bot, 0x45e9b0…fd9215, netted 1,205.0 ETH over 29 transactions and paid another 247.4 ETH in tips.

The best single trade was 0x998894…fe5269 at 10:32: the hacker had just dumped PHA into a V3 pool. Bot 0x45e9b0…fd9215 paid 50.08 WETH for 3.17M PHA and sent it into a V2 pool that hadn't followed, receiving 301.48 WETH: a net 251.4 WETH for a 1.35 ETH tip. Of 294 backruns, 290 were profitable.

With RFQ, a large trader asks market makers or solvers for a quote, signs a fixed-price order, and the quoter settles it on-chain. Racing the freeze, the hacker accepted quotes like $2,990 per ETH while CEXs were around $2,250. Solvers bought the ETH from pools in the same transaction and kept the spread, but had to pay large bribes to win the order.

The largest fill: in 0xa861a5…856f36, solver 0xbeef02…f5c555 delivered 26,227 ETH for the hacker's 75M USDT order, paid the builder 1,070.65 ETH, and kept 119 WETH: about 90% of the value went to the bribe.

Quoting for addresses holding stolen funds is trading with the attacker, which carries legal risk. That's not the same as neutrally arbitraging a price gap.

A bot trades in the victim's direction just before the victim's transaction, the victim fills at a worse price, and the bot closes in the same pool right after. This time the victims were mostly the hacker's altcoin dumps.

The typical case was the hacker's altcoin dumps: the bot sells the same token just before the hacker, pushing the pool price down; the hacker's sell fills lower; the bot buys back cheaper right after and ends in WETH. The two most profitable pairs both hit the hacker: RED at 10:44 (1.9 ETH net, 60.4 ETH in tips) and APE at 11:07 (0.9 ETH net, 43.0 ETH in tips). Not every victim was the hacker: the pairs at 06:35 and 06:41 hit 0x42cdf0…077810's UNI trades.

These 200 pairs netted 51.9 ETH in total, while paying builders 769.2 ETH in tips. Market-maker bot 0x1f2f10…6df387 netted 16.0 ETH and paid 629.4 ETH in tips: a market maker paying to sit next to the hacker's trades, not a sandwicher. The other bots' sandwiches netted about 35.9 ETH. 105 pairs had the hacker as the victim.

The hacker also dumped USDT on DEXs. In the Uniswap V3 USDC/USDT pool, USDT fell to 0.9497 USDC at 04:50 and 0.9181 at 05:10, while CEXs and Chainlink kept USDT near $0.999. Buying USDT with USDC or DAI earned 5–8 cents per USDT.

Pools didn't reprice in sync: V4 versus V3, 5 bp versus 30 bp, Curve tricrypto, and long-tail pools all diverged. Bots bought in the cheap pool and sold in the expensive one in a single transaction, often with flash loans and no capital.

Checked one by one, these 23 transactions netted 192.8 ETH and paid another 227.2 ETH in tips. Next to the other strategies, classic atomic arbitrage was small change.

Almost nobody got liquidated. During the spread window the CEX price of ETH was falling, so positions that borrowed ETH became healthier. The 107 public liquidations netted only 0.2 ETH in total; 38.7 ETH went to builders as tips. One position to watch is the hacker's own: on November 2 it held $59.95M USDT of collateral against 19,766.28 WETH of debt (19,762.41 initially borrowed), with a health factor of 1.0364.

Across 49 sample points, Aave's oracle never differed from CoinGecko's CEX aggregate by more than 0.51%, while DEXs ran up to 38.1% higher. The hacker's own Aave borrow confirms it: 60M USDT of collateral borrowed 19,762.41 WETH, using 99.2% of the limit at Aave's oracle price. At the DEX price of about 2,650 the same borrow would have been 116.5% of the limit and impossible.

Every Chainlink update writes all 31 node reports on-chain. Inside the spread window, the two ETH/USD feeds updated 25 times, for 775 node reports. The highest single report was $2,292.87, while DEXs peaked at $2,861 in the same blocks, and the largest disagreement between nodes was 0.51%.

Chainlink didn't sit above or below the CEX price; it tracked it. All 38 reports fell inside Coinbase's high-low range for that minute. Feeds update when the price moves 0.5% or after one hour at most, and node data reaches the chain in about 20 seconds (median). So Aave's price can lag the market by about 0.5%, which is negligible next to a 17–38% spread. The USDT/USD feed never updated during the window at all: the DEX discount never moved the market-wide price.

At 05:47 one transaction froze 11 Aave assets and set the LTV of 5 collateral assets to 0, for about 14.7 hours (until 20:26). Liquidation thresholds didn't change, so existing positions weren't liquidated, but nobody could borrow: