On Saturday, October 17, USDT transfer volume reached $3.69 trillion. That is 35 times the previous record from April and 20 times the amount of USDT in circulation. The abnormal spike was flagged as soon as the data appeared. No legitimate market event explained what was happening.
The cause was a $207K exploit in BiFi Lending, a protocol whose USDT lending pools had sat almost unused for years. A white-hat bot, one that copies exploits as they execute and then returns the money, reached the pool before the original attacker. After that, about 18,370 transactions by copycat bots ran trillions of dollars in borrowed USDT through the system, earning almost nothing in the end.
This breakdown traces how the funds left the protocol, how most of them came back and why gross transfer volume, a metric that counts every transfer, including when money ultimately goes nowhere, is a poor reflection of what really happened.
Why BiFi Lending's unused USDT pools were vulnerable
BiFi Lending was created by Bifrost and launched on Ethereum, and a few weeks later on BNB Chain. By October 2026, the protocol's USDT pools were barely in use. The BNB Chain pool saw only a few small transactions a month. According to a public review of the exploit, the Ethereum pool had not been used for about 36 days.
It was this inactivity that created the opening for the attack. When a BiFi market sits idle for a long time, interest owed for the entire period accumulates in it. The next time the market is called, this interest is applied to the transaction.
A borrower who bundled dozens of deposit, borrow and repay operations into a single transaction could collect the interest accumulated over 36 days many times over. BiFi has not published a report on the causes and consequences of the attack.
05:43 UTC: a white-hat bot gets ahead of the BiFi attackers
Early in the morning of October 17, the original attacker deployed a smart contract designed to drain the Ethereum pool. But another transaction went through first.
It came from c0ffeebabe.eth, a bot known for copying exploits as they execute and returning the funds. The bot took a $40.5M USDT flash loan from Morpho.
The bot then ran the money through the BiFi pool, repaid the Morpho loan and swapped the proceeds for 68 ETH. It paid $2 in network fees and offered the block builder a tip of 0.99 ETH, about $2.4K, to make sure the transaction landed in the block ahead of the rest. A block builder is the blockchain infrastructure participant that decides the order in which transactions are included in a block.
This single transaction withdrew $165.6K, 99% of all the funds the Ethereum pool lost that day.
06:13 UTC: the same bug is exploited on BNB Chain
Thirty minutes later, the bug was exploited on BNB Chain, where BiFi had deployed the same code. A single transaction created a smart contract, took a $35.7M fee-free flash loan from PancakeSwap's Infinity Vault, ran the same loop of operations and withdrew $34.1K. That was 85% of the BNB Chain pool's losses. Network fees came to about 50 cents.
The contract was built for one-time use, and the money never came back. By 06:14, the two decisive transactions had already completed. Together, they withdrew $199.6K.
05:44 to 09:34 UTC: 18,370 copycat transactions
On BNB Chain, copycat bots appeared three seconds after the first attack. These automated programs monitor the blockchain for profitable transactions and replicate them within seconds. On Ethereum, they started at 05:44, a minute after the c0ffeebabe.eth transaction. At least two separate bot operators were active at the same time. Each of them used the same wallets and smart contracts on both networks.
Almost all of that amount, except about one tenth of a cent, went on network fees.
Over almost four hours, about 18,370 such transactions moved $3.63 trillion in USDT. They withdrew $7.2K from the pools: $6.2K on BNB Chain and $1K on Ethereum. Meanwhile, $6.8K was spent on network fees, known as gas, and block builder tips. The combined profit came to about $470. The most active operator earned about $350 on BNB Chain but lost about $100 on Ethereum.
Who withdrew how much from the BiFi USDT pools on October 17–18, 2026
| Participant | Network | Transactions | USDT withdrawn | USDT moved | Fees | Returned |
|---|---|---|---|---|---|---|
| c0ffeebabe.eth, 05:43 UTC | Ethereum | 1 | $165.6K | $0.36 billion | $2.4K* | $159.1K** |
| One-time bot, 06:13 UTC | BNB Chain | 1 | $34.1K | $0.20 billion | $0.50K | Nothing |
| Subsequent c0ffeebabe.eth transactions until 09:17 UTC | Ethereum | 94 | $0.5K | $32.7 billion | $0.4K | Counted above** |
| Copycat bots, 05:44–09:34 UTC | Both networks | about 18,370 | $7.2K | $3.63 trillion | $6.8K | Nothing |
| Total | about 18,460 | $207.3K | $3.66 trillion | $9.6K | $159.1K |
* Fees include the network fee and payments to the block builder. In its first transaction, c0ffeebabe.eth paid $2 in gas and gave the block builder a tip of 0.99 ETH, about $2.4K.
** 159,104 USDC was returned to the BiFi USDT pool on Ethereum on October 18. That is about 96% of the $166.1K that c0ffeebabe.eth withdrew across the two table rows. Other BiFi markets lost about $10K more; those funds are not included here. Source: analysis of public blockchain data.
October 18: c0ffeebabe.eth returns the funds
The next day, at 17:21 UTC, c0ffeebabe.eth bought 159,104 USDC and sent it to the BiFi USDT pool on Ethereum. That is 96% of the total $166.1K the bot withdrew, including the $0.5K obtained in later, smaller transactions. The bot kept the remaining $7K.
Twelve minutes later, a scam bot sent a worthless USDC-lookalike token to the same pool, for exactly the same amount. The transfer came from an address specially created to resemble the address of c0ffeebabe.eth.
After accounting for the return, the two BiFi USDT pools' losses come to about $48K, most of it on BNB Chain. The same morning, the same bots, including c0ffeebabe.eth, withdrew about $10K more from other idle BiFi markets. The affected assets included BNB, USDC, DAI, BTCB, BUSD, ETH and LINK.
Why the record $3.69 trillion in USDT transfers was mostly statistical noise
By gross transfer volume, October 17 was the biggest day for USDT since at least April. That day, the token moved between addresses across all networks to the tune of $3.69 trillion. That is 35 times the previous high of $106 billion recorded on June 8, and 71 times the typical daily volume of $52.1 billion. On BNB Chain alone, the figure reached $3.51 trillion, against a typical volume of about $6.1 billion.
Net transfer volume tells a different story. It nets out funds that leave an address and come straight back. On October 17, net USDT transfer volume was $3.9 billion, about the same as the $4.1 billion of the previous Saturday.
This gap matters beyond the assessment of a single exploit. Stablecoin rankings and market analytics dashboards often cite gross volume as a measure of an asset's real usage.
Noise on the blockchain: why almost a third of TRON transfers are spamSep 16, 2026Read more
What the BiFi exploit means for stablecoin volume data
Gross volume should be viewed alongside net flows. Free flash loans allowed a bot to move $196M to earn a tenth of a cent. Large transfer figures may reflect not real economic activity but the amount of capital available to borrow. Net transfer volume and information about who is on the other side of each transaction help show which funds actually changed hands.
Unmaintained smart contracts keep running. The BiFi Lending pools still held funds, and the pools themselves kept responding to any call. Today, the BNB Chain pool holds about $21K. If a deployed smart contract is no longer maintained, it should be paused or drained of funds.
White-hat recovery depends on timing. The funds on Ethereum came back because the white-hat bot got to the pool first. On BNB Chain, 30 minutes later, that did not happen. A protocol running on several networks needs a mechanism to pause operations on all of them at once.
