Incident case file

Ethereum Trader — Same-Block Backrun Extraction via Low-Liquidity Pool

Incident date July 7, 2026

0 views

ClosedEthereumMEV / Same-Block BackrunCluster: ETHLIT-MEVBACKRUN-2026-07

Estimated loss

$2.0M

Victims identified

Victim group joining is coming soon.

Investigation

100%

Facts and investigation

Attacker: Titan Builder (Ethereum block builder; not a wallet-drain hacker in the classical sense — this was legal but predatory same-block MEV extraction, not a smart contract exploit or theft of custody).

Funds moved to: Approximately 1,072 WETH (~$1.8M) extracted as a 'builder reward' and paid to Titan Builder. Titan Builder's cumulative 2026 block-building revenue is reported at $112.6M by DefiLlama. No recovery is possible or applicable; this was value extraction via public mempool/routing mechanics, not custody compromise.

Victim wallet: 0xff89a35854e9c203bba1cc3ca408d0822cbe981e. Trade was routed via a 0x aggregator through a low-liquidity AVAIL/WETH Uniswap v3 pool priced roughly 120x above a sustainable execution level. ETH used for the swap had been withdrawn from Binance shortly before the transaction.

Timeline: July 7, 2026, 01:59 UTC: victim swaps 1,126.44 ETH via a 0x aggregator route that passes through a low-liquidity AVAIL/WETH Uniswap v3 pool. The distorted pricing in that pool allows Titan Builder to execute a same-block backrun, extracting approximately 1,072 WETH before the transaction settles, then paying out roughly 1,018 ETH (~$1.8M) to itself as a builder reward. The victim receives only 5,775.66 LIT (approximately $14,500) in exchange for the 1,126.44 ETH swapped — a 99.3% loss relative to the ETH's market value. GoPlus Security characterized the pattern as 'a real, highly imbalanced backrunner arbitrage, not a classic sandwich attack' — a textbook same-block backrun extraction rather than a protocol hack.

Sources and coverage

Victim testimonies

No testimonies yet.

+ Add my testimony → (coming soon)