Analysis: Suspected Binance attacker mistakenly used MetaMask to pay for gas, potentially leaving traceable logs.

BlockBeats news, October 30 - Protocol engineer Justin Kalland posted that an address suspected to be related to the Binance hot wallet attack transferred approximately 175 million USDT to a new wallet, and about 2.5 minutes later received 2 ETH. Subsequently, despite having sufficient Gas, it still called MetaMask Gas Station. In the same block, there were consecutive occurrences of Gas Station replenishing ETH, unlimited USDT approval to Kyber router, and payment of approximately 127.67 USDT to Gas Station, with the replenished ETH amount precisely matching the maximum Gas budget of the two transactions down to the wei.

Analysts pointed out that this may be due to the attacker hastily mistakenly selecting USDT to pay for Gas when using the MetaMask wallet. Transactions paid via MetaMask Sentinel go through its channel rather than ordinary RPC, potentially leaving off-chain logs containing information such as IP. Kalland stated that among the attack-related wallets checked, only this address showed Gas Station usage records, and called on MetaMask to retain relevant Web2 logs. The involved address is 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.