Share via:
- Updated on: October 23, 2026
On Saturday, October 17, USDT moved $3.69T. That is 35 times its busiest day since April and 20 times the amount of USDT in circulation. Crystal Foresight flagged the spike as soon as the data landed. No legitimate market event explained it.
The cause was a $207K exploit on BiFi Lending, a protocol whose USDT pools had sat largely dormant for years. A white-hat bot, which copies attacks in progress and hands the money back, reached the pool before the original attacker. Then about 18,370 copycat bot transactions churned trillions of dollars of borrowed USDT to win almost nothing.
This analysis traces how the money left, how most of it came back, and why gross transfer volume, which counts every transfer including money that goes nowhere, is a poor guide to what happened.
Key takeaways
Two transactions did almost all the damage. A bug in two BiFi Lending USDT pools let borrowers drain $207.3K. Two transactions, 30 minutes apart, took 96% of it.
Most of the money came back. On Ethereum, the white-hat bot c0ffeebabe.eth reached the pool before the attacker and returned $159.1K the next day. The $34.1K taken on BNB Chain has not been returned.
Bots moved trillions to earn hundreds. Copycat transactions moved $3.63T of USDT, took $7.2K, and spent $6.8K on network fees and builder tips. They kept about $470 between them.
The headline number was noise. USDT’s net transfer volume, which cancels out money that goes out and straight back, was $3.9B that day, in line with the previous Saturday.
Why BiFi Lending’s dormant USDT pools were exposed
BiFi Lending, built by Bifrost, and on BNB Chain a few weeks later. By October 2026, its USDT pools saw little use. The BNB Chain pool handled a few small transactions a month. The Ethereum pool, according to a public exploit roundup, had not been touched for about 36 days.
That inactivity created the opening. When a BiFi market sits idle, it stores up the interest owed for the whole period and applies it the next time someone uses the market. The roundup reports that the contract applied this interest on every action within the same block, not once.
A borrower who packed dozens of deposits, borrows, and repayments into one transaction could collect 36 days of interest over and over. BiFi has not published a post-mortem.
05:43 UTC: a white hat front-runs the BiFi exploit
According to the roundup, the original attacker deployed a contract to drain the Ethereum pool early on October 17. Another transaction got there first, a move known as front-running.
It came from c0ffeebabe.eth, a white-hat bot with a public record of copying exploits as they happen and returning the money. It borrowed $40.5M of USDT from Morpho in a flash loan, a loan that costs nothing as long as it is repaid within the same transaction. It cycled the money through BiFi’s pool, repaid Morpho, and swapped the proceeds into 68 ETH. It paid $2 in gas, plus a 0.99 ETH (about $2.4K) tip to the block builder, the party that orders transactions in each block, to make sure it landed first.
That one transaction took $165.6K, 99% of everything the Ethereum pool lost that day.
06:13 UTC: the same bug hits BNB Chain
Thirty minutes later the bug was exploited on BNB Chain, where BiFi had deployed the same code. A single transaction created a contract, borrowed $35.7M in a fee-free flash loan from PancakeSwap’s Infinity Vault, ran the same loop, and took $34.1K. That was 85% of the BNB Chain pool’s loss, for about 50 cents in network fees.
The contract was built to be used once, and the money has not been returned. By 06:14 the two transactions that mattered were over. Together they had taken $199.6K.
05:44 to 09:34 UTC: 18,370 copycat transactions
On BNB Chain, copycat bots arrived three seconds later. These automated programs watch the blockchain for profitable transactions and replay them within seconds. On Ethereum they had started at 05:44, a minute after c0ffeebabe.eth. At least two separate bot operators, each running the same wallets and contracts on both chains, worked them at once.
Each copycat transaction borrowed about $35.8M, cycled it through the pool 20 times, and repaid the loan. Every step counted as a USDT transfer. A single transaction recorded about $196M of volume while taking just $0.33 from the pool, all but a tenth of a cent of it spent on gas.
Figure 1. One copycat transaction, step by step. BNB Chain, 06:42 UTC, October 17, 2026. All five steps happen inside a single transaction. Source: Crystal Foresight analysis of public on-chain data.
Over nearly four hours, about 18,370 such transactions moved $3.63T of USDT. They took $7.2K from the pools, $6.2K on BNB Chain and $1.0K on Ethereum, and spent $6.8K on network fees, known as gas, and builder tips. Their combined profit was about $470. The busiest operator made about $350 on BNB Chain and lost about $100 on Ethereum.
Figure 2. The money was gone in two transactions; the volume came afterward. USDT taken from the two BiFi pools (top) against USDT moved by every transaction that touched them (bottom), per minute, October 17, 2026. The $3.66T total includes the first two transactions and c0ffeebabe.eth’s later ones. Source: Crystal Foresight analysis of public on-chain data.
Table 1. Who took what from BiFi’s USDT pools, October 17-18, 2026
Who | Chain | Txs | USDT taken | USDT moved | Fees | Returned |
|---|---|---|---|---|---|---|
c0ffeebabe.eth, 05:43 UTC | Ethereum | 1 | $165.6K | $0.36B | $2.4K* | $159.1K† |
Single-use bot, 06:13 UTC | BNB Chain | 1 | $34.1K | $0.20B | $0.50 | None |
c0ffeebabe.eth, follow-ups to 09:17 UTC | Ethereum | 94 | $0.5K | $32.7B | $0.4K | Included above† |
Copycat bots, 05:44-09:34 UTC | Both | ~18,370 | $7.2K | $3.63T | $6.8K | None |
Total | ~18,460 | $207.3K | $3.66T | $9.6K | $159.1K |
*Fees are gas plus payments to the block builder. c0ffeebabe.eth’s first transaction paid $2 in gas and a 0.99 ETH (about $2.4K) builder tip. †159,104 USDC returned to BiFi’s Ethereum pool on October 18, about 96% of the $166.1K c0ffeebabe.eth took across both rows. BiFi’s other markets lost about $10K more, not included here. Source: Crystal Foresight analysis of public on-chain data.
October 18: c0ffeebabe.eth returns the funds
At 17:21 UTC the next day, c0ffeebabe.eth bought 159,104 USDC and sent it to BiFi’s Ethereum USDT pool. That is 96% of the $166.1K it took in total, including $0.5K from later, smaller transactions. It kept the remaining $7K.
Twelve minutes later, a scam bot sent the same pool a worthless lookalike “USDC” token for exactly the same amount. It came from an address designed to resemble c0ffeebabe.eth’s. This tactic, known as address poisoning, relies on someone later copying the wrong address from the transaction history.
With the return counted, BiFi’s two USDT pools are down about $48K, most of it on BNB Chain. The same bots, including c0ffeebabe.eth, also took about $10K from BiFi’s other idle markets that morning, including BNB, USDC, DAI, BTCB, BUSD, ETH, and LINK.
Why USDT’s $3.69T day was mostly noise
Measured by gross transfer volume, October 17 was USDT’s largest day since at least April. The token moved $3.69T across all chains, 35 times its previous high of $106B on June 8 and 71 times a typical day of $52.1B. BNB Chain alone recorded $3.51T, against a usual $6.1B.
Figure 3. USDT daily transfer volume, all chains, April 1 to October 20, 2026. The October 17 total was about 20 times USDT’s supply of $183.6B; BNB Chain accounted for $3.51T of it. Source: Crystal Foresight.
Net transfer volume tells a different story. It cancels out money that leaves an address and comes straight back. On October 17, USDT’s net transfer volume was $3.9B, in line with $4.1B the previous Saturday.
The gap matters beyond one exploit. Stablecoin rankings and market dashboards often cite gross volume as evidence of use. On October 17, 98% of USDT’s reported volume came from bots recycling borrowed money through two lending pools. A reader comparing stablecoins by volume alone would have drawn the wrong conclusion.
What the BiFi exploit means for stablecoin volume data
Read gross volume next to net flows. Free flash loans let a bot move $196M to earn a tenth of a cent. Large transfer figures can reflect how much capital is available to borrow rather than how much activity is real. Net transfer volume, and who sits on the other side of each transfer, show what changed hands.
Unmaintained contracts remain live. BiFi’s USDT pools still held funds and still responded to anyone who called them. The BNB Chain pool holds about $21K today. A deployment that is no longer maintained should be paused or emptied.
White-hat rescue depends on timing. Ethereum’s funds came back because a white hat reached the pool first. On BNB Chain, 30 minutes later, nobody did. A protocol on several chains needs to be able to pause all of them at once.
Frequently asked questions
What happened to BiFi Lending on October 17, 2026?
An interest-accounting bug in two dormant BiFi Lending USDT pools, on Ethereum and BNB Chain, let borrowers drain $207.3K. A white-hat bot took most of the Ethereum funds before the attacker could and returned $159.1K the next day.
Why did USDT transfer volume reach $3.69T on October 17, 2026?
About 18,370 copycat bot transactions repeatedly deposited and withdrew flash-loaned USDT through the exploited pools. Each one recorded about $196M of transfers, adding up to $3.63T in under four hours.
What is the difference between gross and net transfer volume?
Gross transfer volume adds up every transfer, including money that moves out and straight back. Net transfer volume cancels out those round trips. On October 17, USDT’s gross volume was $3.69T and its net volume was $3.9B.
What is a flash loan?
A flash loan is borrowed and repaid inside one blockchain transaction. If it is not repaid, the whole transaction is reversed, so the lender takes no risk and often charges no fee.
What is a white-hat bot?
A white-hat bot watches for exploits in progress, copies them before the attacker can finish, and returns the funds to the affected protocol. c0ffeebabe.eth is one of the best known.
See what stablecoin volume really means
Crystal Foresight tracks supply, transfer volume, and net flows for major stablecoins across chains. It separates gross volume from genuine activity, so issuers, compliance teams, and institutions can spot anomalies like October 17 as they happen.
