Analysis: Suspected Binance attacker misused MetaMask to pay gas fees, potentially leaving traceable logs.

Protocol engineer Justin Kalland posted that an address suspected to be linked to the Binance hot wallet attack transferred roughly 175 million USDT to a new wallet, then received 2 ETH approximately 2.5 minutes later. Despite having sufficient gas, the address still invoked MetaMask Gas Station. Within the same block, three events occurred consecutively: a gas top-up via the Gas Station, an unlimited USDT approval for Kyber routing, and a payment of around 127.67 USDT to the Gas Station. The amount of ETH topped up aligns exactly with the maximum gas budget of the two transactions down to the wei. Analysts noted this may stem from the attacker mistakenly selecting USDT for gas payment while using MetaMask. Transactions paid via MetaMask Sentinel run through its dedicated channel instead of a standard RPC, potentially leaving off-chain logs containing data such as IP addresses. Kalland stated that among the attack-related wallets he reviewed, only this address showed a record of using Gas Station, and urged MetaMask to retain the relevant Web2 logs. The address in question is 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.