11,217 ETH. That is the number that flowed to Ethereum proposers inside a window of roughly four and a half hours. The builders kept 564 ETH. Divide the two and you get 19.9 to 1 โ the proposer side capturing about 95.2% of the entire fee stream generated by a single actor's forced exit.
That actor was a hacker. Roughly $119 million in assets, pushed through public channels, at whatever price the book would absorb.
I have audited enough of these events to know what a clean number usually means. It usually means a clean story is being sold to you. And the story being sold here โ 'validators pocketed $30 million from a criminal' โ rests on a fee decomposition that the source material never actually provides. The single most important number in this event is the one that was never published: the base-fee burn. Everything downstream of that omission is arithmetic dressed up as analysis.
So let me be explicit about what I am working with, because most people covering this are not.
The underlying material is a short brief, not a report. No byline. No methodology appendix. An email subscription pitch wedged into the layout. Seven extractable information points. The critical figures โ the 11,217 ETH, the 564 ETH, the $119 million โ are single-sourced estimates that have not been cross-verified against Chainalysis, Nansen, or any public Dune dashboard. There is no peer review. There is no disclosure of whether the fee figure includes burned base fees, or searcher profit, or AMM liquidity provider fees.
That matters more than the headline. A number without a decomposition is not data. It is a narrative artifact with a decimal point.
Due diligence is just paranoia with a spreadsheet. So let me open the spreadsheet.
The supply chain nobody explains before the headline
To understand why this event is interesting โ and why the mainstream framing of it is structurally wrong โ you have to hold the Ethereum transaction supply chain in your head at the same time. Most readers cannot, and the people writing the headlines know it.
A transaction does not travel from a wallet to a validator. It travels through at least four intermediaries, each of which captures value.
A searcher spots an opportunity โ a large swap about to hit a public automated market maker, a liquidation threshold, an arbitrage gap. The searcher constructs a bundle. Then a builder assembles competing bundles into an optimal block, simulating execution order to maximize total fee extraction. The builder bids for the right to have that block proposed. That bid flows through a relay โ a trusted intermediary sitting between builders and validators โ into the hands of a proposer, the validator selected to produce the block.
Post-Merge, this is formalized as PBS: proposer-builder separation. Post-MEV-Boost, it is an open auction, run every twelve seconds, thousands of times a day.
EIP-1559 sits underneath all of it, and this is where the forensic work begins. Since August 2021, every transaction pays two things. A base fee, which is algorithmically set by network congestion and burned โ destroyed, permanently removed from supply. And a priority fee, or tip, which is passed to the validator who includes the transaction. The base fee does not go to anyone. It goes to the incinerator, and every ETH holder benefits proportionally through reduced supply.
The brief does not mention the burn at all. Not once. Not in passing. That is not an oversight. That is a load-bearing omission.
Interpreting 11,217 ETH: two mutually exclusive worlds
Here is where the analysis gets sharp, and where I diverge from every take I have seen on this event.
There are two ways to read that 11,217 ETH figure. They produce radically different conclusions about what actually happened, and the source material does not tell you which one applies.
Interpretation A โ the brief's implicit read. All 11,217 ETH represents priority fees paid directly to proposers as tips. If true, the hacker was paying tips at a rate of roughly 2,500 ETH per hour. Compare that against Ethereum's normal daily fee volume โ total, across every transaction on the network, all users, all applications. The tip rate implied by Interpretation A would push the network's fee throughput to somewhere between twenty and sixty times its baseline. For four and a half hours straight. On a single actor's activity.
That is not impossible. It is, however, extraordinary, and extraordinary claims require a methodology note that this brief does not contain.
Interpretation B โ the more probable reality. The 11,217 ETH is a total transaction fee figure: base fee burn plus priority fee, collapsed into one number by whatever query the data indexer ran. If that is the case, then the statement 'validators pocketed $30 million' is a material attribution error. Some unknown but potentially enormous fraction of that ETH was destroyed, not paid out. The validators got the tip portion. Every ETH holder got the burn portion, distributed across the entire supply.
Which is true? The source does not say. And that silence is the story.
I put the probability of Interpretation B at no less than the probability of Interpretation A. Medium confidence, and I am being generous to the brief.
Why does this matter beyond pedantry? Because the burn is a transfer to all holders, and the tip is a transfer to a small validator set. Those are politically and economically opposite outcomes. One is a redistribution toward broad ownership. The other is a concentration event. The brief chose the concentration framing โ 'windfall' โ without establishing which mechanism produced the number. That is a narrative decision masquerading as a data point.
The missing actors: searchers, LPs, and the 73.5% that vanished
Run the subtraction. It is the most revealing calculation in this entire event, and almost nobody has run it.
The hacker lost roughly $119 million. Proposers received approximately $30 million. Builders kept approximately $1.5 million. Combined, that is about $31.5 million โ or 26.5% of the stated loss.
Where did the other $87.5 million go?
The brief does not say. But the transaction supply chain tells you exactly where to look, and the fact that the brief skips all four destinations is diagnostic.
First: searchers and sandwich operators. A hacker dumping nine figures through a public mempool is the single most attractive target in DeFi. Every MEV bot with a working RPC endpoint and a mempool listener is watching. The moment that transaction enters the public mempool, it is visible. Searchers construct bundles that buy ahead of it and sell behind it, extracting the price impact for themselves. On a forced, price-insensitive swap of this size, sandwich extraction is not a rounding error. It is plausibly the largest single line item in the entire event โ and the brief does not mention the word 'searcher' once.
Second: AMM liquidity providers. Every swap pays the pool fee โ typically 0.05% to 1% per hop, sometimes more on volatile pairs. Routing a nine-figure notional through multiple hops compounds that. A meaningful share of the loss accrued to LPs as legitimate fee income. The brief does not mention LP fees.
Third: slippage. This is not a fee paid to anyone. It is the price degradation from consuming order book โ or pool โ depth. On a large, rushed, single-direction swap, slippage against thin bear-market liquidity can run into double-digit percentages on the notional. That value does not go to a counterparty; it is simply the difference between the price the hacker wanted and the price the market gave them. Slippage is the purest form of loss in the entire event, and the brief does not name it.
Fourth: the base-fee burn. As established, undisclosed.
What the brief actually did was pick the two most legible, most visible line items โ proposer tips and builder margin โ and build a headline around them. It ignored the three largest destinations for the hacker's money. That is not analysis. That is spotlit accounting.
And note the arithmetic consequence, because it cuts against the brief's own thesis. If proposers captured $30 million out of a $119 million loss, then the 'validators got rich off crime' narrative describes a quarter of the event. The other three quarters went to bots, LPs, and the incinerator. The headline number, read honestly, weakens the headline.
The 564 ETH line is technically wrong, and that matters
Let me be precise about the builder figure, because the brief's language here is not merely loose โ it is category-confused.
Builders are auction intermediaries. They do not 'keep' transaction fees in the way the brief implies. What a builder retains is the bid spread: the difference between the total value it extracts from the block and the amount it bids to the relay for the right to have that block proposed. That spread is a margin, and it is compressed toward zero by competition. A 19.9 to 1 proposer-to-builder ratio is, in theory, exactly what a healthy, competitive auction produces. Builders bid away almost everything, keeping only enough to cover risk and infrastructure.
So the ratio is not evidence of collusion, or of a broken auction, or of builders being cheated. It is evidence that the auction worked. A thin builder margin is the signature of competitive bidding, not of extraction.
But โ and here is the adversarial read โ the brief frames 564 ETH as if it were an anomaly worth flagging. It is not. If anything, a 95.2% proposer share is the expected result in a single-block, high-value, low-competition scenario like a forced liquidation. The anomaly to flag is the opposite: in a normal competitive regime, you would expect the ratio to compress even harder toward the proposer, and the builder margin to be thinner still. The fact that builders retained ~4.8% tells you the auction was less contested than a theorist would predict โ which is itself a warning sign about relay concentration and builder oligopoly, not about proposer greed.
That is the signal the brief missed entirely. The MEV-Boost relay layer is not a distributed, adversarial market. A small number of relays process a large majority of flow. A small number of builders dominate block construction. The 'competitive auction' assumption is an assumption, and this event is one data point testing it. On the evidence available, the auction cleared at a ratio consistent with competition but with a fatter-than-theoretical builder margin. Draw your own conclusion โ but draw it from the ratio, not from the headline.
Reverse-engineering the timestamp: what the numbers tell you that the text won't
I have been doing this long enough that I treat missing timestamps as an invitation.
Take 11,217 ETH and divide by a $30 million valuation. You get an implied ETH price of roughly $2,670 per coin. Cross-check against the 564 ETH figure at $1.5 million โ you get roughly $2,660. The two internal estimates are consistent with each other to within half a percentage point, which is the one thing about this brief that shows methodological discipline.
That consistency lets me place the event. An ETH price near $2,670 does not match the post-ETF approval euphoria period, when ETH was trading well above $3,500. It does not match the late-2021 highs. It matches a lower band โ the kind of range ETH occupied after the ETF launch settled into a bear-market grind, through the period when the market was repricing on macro liquidity and ETF flows were net-negative for stretches. That narrows the window considerably, though it does not pin it precisely, and I will not pretend it does. Medium confidence.
Why bother? Because in a bear market, timing is the whole ballgame. A $119 million forced liquidation executed during a low-liquidity weekend produces a completely different slippage profile than the same notional executed during a Tokyo-London overlap on a Tuesday. The loss figure โ and the fee figure โ are functions of the liquidity environment, not just of the hacker's incompetence. Any analysis that ignores the when is only analyzing the what.
The execution-path forensics: a $119 million operator with no tradecraft
This is where my cryptography background and my MEV surveillance work converge, and where I think the real story lives.
Think about what it takes to acquire nine figures of illicit assets. You need wallet hygiene, key management, cross-chain movement, mixing, and enough operational security to avoid clustering heuristics. That is not trivial. It requires sophistication.
Now think about what this actor did with the proceeds. They sent large, price-insensitive swaps through the public mempool, paying priority fees high enough to push the network into an extreme fee regime for hours.
That is the behavior of someone who has never heard of a private RPC.
There are at least four well-known mechanisms an operator with moderate technical literacy uses to avoid exactly this outcome. Private transaction submission โ Flashbots Protect, MEV Blocker, and equivalents โ routes your transaction directly to builders without mempool exposure, eliminating sandwich risk entirely. Batch auction protocols like CoW Swap match orders peer-to-peer or against solvers, bypassing AMM slippage on large notionals. OTC desks and block trades settle nine figures off-book at negotiated prices. And simply splitting the order across hours, pairs, and venues reduces per-swap impact to noise.
The hacker used none of them. Or at least, the public-mempool execution path implied by the fee magnitude suggests they used none of them. That is the anomaly. A sophisticated asset thief with primitive execution infrastructure.
That mismatch is worth more than the fee number. It tells you the threat actor profile of this cycle's large-scale crypto theft is bifurcated: people who can steal, and people who can trade, are not the same people. The industry has spent years hardening custody. It has spent comparatively little hardening the liquidation layer โ the moment an attacker has to convert ill-gotten assets into something usable. That is the chokepoint, and it is wide open. Every DEX, every AMM, every public mempool is a surveillance surface that a determined operator can simply refuse to touch.
The fee event is not the story. The fact that the fee event was avoidable is the story. This hacker lost $31.5 million to validators and builders for no operational reason other than not knowing that MEV-Blocker-shaped tools exist. That is a competence failure, not a market failure. And it tells you that the next generation of large-scale attackers will fix it โ which means the surveillance dividend this event hands to analysts will not repeat.
The protocol-level consequence: this event is an argument, not a footnote
Here is where I go beyond the brief, and where I suspect most readers will find the actual information gain.
This event is not merely an interesting anecdote about a hacker's mistake. It is a first-class data point for two live protocol debates on Ethereum's roadmap.
First: ePBS (EIP-7732), enshrined proposer-builder separation. The current MEV-Boost architecture routes value through trusted relays and outsourced builders. ePBS pulls that auction into the protocol itself, removing the relay from the trust path. This event is a near-perfect natural experiment in why. Over four and a half hours, a single exogenous shock routed 95.2% of an entire fee stream to whichever proposers happened to be selected during that window. That is not redistribution. That is a lottery. Enshrining the auction does not eliminate the lottery, but it does make the mechanics auditable at the protocol layer rather than dependent on relay disclosure.
Second: MEV Burn โ the family of proposals that would smooth proposer windfalls by burning a portion of the priority fee. The argument for MEV Burn has always been 'proposer income is wildly lumpy and capturing it creates a centralizing incentive for staking pools with the best relay connections.' This event is the empirical exhibit. A proposer selected during those four and a half hours received an order-of-magnitude income spike compared to baseline. A proposer selected an hour earlier or later got nothing. That is a variance problem, and variance problems are centralization problems, because only large, well-capitalized operators can absorb variance.
Notice that the brief mentions neither ePBS nor MEV Burn. It treats the event as a curiosity, isolated from the protocol debates it directly informs. That is the difference between reporting a number and understanding what it is evidence for.
Due diligence is just paranoia with a spreadsheet โ and the spreadsheet says this event is an argument for enshrining the auction, not a scandal about validators getting lucky.
The cross-ecosystem comparison the brief didn't make
One more angle, and then I'll close.
Run the same scenario on a mainstream Layer 2. A hacker forced to liquidate nine figures on Arbitrum, Base, or OP Mainnet. The transactions still pay fees. The sequencer still orders them. But on those chains, the sequencer is a centralized operator โ usually a single company โ and the value captured by ordering those transactions flows to that company's balance sheet, not to a distributed validator set.
Same economic event. Same $30 million of ordering revenue. Radically different visibility.
On Ethereum L1, I can reconstruct this entire event from public data. I can see the fee flow, the proposer distribution, the block-level allocation. I can argue about the decomposition precisely because the raw material is auditable. On an L2, the equivalent capture would be an internal line item. There would be no relay auction to inspect, no builder margin to debate, no burn to check because the fee model is different entirely. The value would simply appear.
So the 'validators got rich' narrative, read against the competitive landscape, inverts. The reason this event looks like a scandal is that Ethereum L1 is the only major execution environment transparent enough to let you see it. The same event on an L2 would be invisible. That is not a defense of the windfall โ it is an observation about which ecosystems let you audit the windfall at all.
The contrarian read: the industry priced the headline and ignored the mechanism
Let me state the blind spot plainly, because it is the one I have run into over and over in bear markets.
The dominant framing of this event is a morality play: a criminal's money was taken by validators, and validators are therefore complicit in something. That framing is emotionally satisfying and analytically empty. It also happens to be weakened by the source's own numbers, which show validators capturing roughly a quarter of the loss, with the remainder vaporizing into slippage, sandwich extraction, LP fees, and an undisclosed burn.
The real contrarian position is not that validators did anything wrong. It is that the industry still cannot decompose a fee. Seven years into the MEV research program, with hundreds of millions of dollars in academic funding and dedicated data vendors, the reporting on this event could not tell its audience whether the central figure included burned base fees. That is a failure of the data layer, not of the actors. And it matters more in a bear market, because in a bear market the only durable thing anyone is measuring is fee flow โ who pays, who receives, who is left holding the loss. If that measurement is unreliable at the moment of maximum stress, then every protocol valuation built on it is built on sand.
What I am watching next
Three things, in order.
Watch whether the data providers issue a corrected decomposition of this event โ specifically, whether the 11,217 ETH includes base-fee burn. If a corrected figure appears and the burn was substantial, the 'validator windfall' story collapses by an order of magnitude and everyone who ran the headline owes their readers a correction.
Watch for the first forced liquidation executed entirely through private RPC and solver-based batch auctions. When it happens, the fee signature will vanish, and the surveillance surface this event just handed the industry will close permanently.
And watch ePBS. If the roadmap accelerates, remember that this hacker's $119 million mistake is part of why.
One question to leave you with: if $87.5 million of a nine-figure loss disappeared into venues no one is auditing and a burn no one disclosed, whose pockets should you actually be watching?