Analysis: Suspected Binance attacker mistakenly used MetaMask to pay gas fees, potentially leaving a traceable record.

PANews October 30 news: Protocol engineer Justin Kalland posted that the Binance attacker may have made an operational mistake. The attacker transferred 175 million USDT to a new wallet, and about 2.5 minutes later the wallet received 2 ETH for gas, consistent with the pattern of their other attack wallets. Two minutes after that, the wallet used MetaMask's Gas Station even though it already had enough gas. Three consecutive transactions were bundled into the same block: the ETH top-up from Gas Station, an infinite USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The ETH top-up amount was exactly equal to the sum of the maximum gas budgets of the latter two transactions, precise to the wei.

PANews October 30 news: Protocol engineer Justin Kalland posted that the Binance attacker may have made an operational mistake. The attacker transferred 175 million USDT to a new wallet, and about 2.5 minutes later the wallet received 2 ETH for gas, consistent with the pattern of their other attack wallets. Two minutes later, the wallet used MetaMask's Gas Station even though it already had enough gas. Three consecutive transactions were bundled into the same block: the ETH top-up from Gas Station, an infinite USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The ETH top-up amount was exactly equal to the sum of the maximum gas budgets of the latter two transactions, precise to the wei.

Kalland speculated that the attacker was using a MetaMask wallet at the time and, in a hurry, mistakenly selected USDT as the gas payment method. MetaMask sometimes defaults to this, and the top-up order within the same block is also consistent with its implementation. He noted that using Gas Station requires going through MetaMask Sentinel, and transactions pass through MetaMask rather than a normal RPC, an interaction that may leave off-chain records in MetaMask, including IP metadata. Among all the attacker wallets he examined, this is the only one that shows use of Gas Station.