Developers claim that the Binance hacker may have made a mistake and could be located through MetaMask by IP

Smart contract developer Justin Kalland posted on X that the Binance hacker may have made a potential mistake, and MetaMask should retain any Web2 logs it can access as much as possible. He stated that the hacker sent 175 million USDT to a new wallet, and about 2.5 minutes later, that wallet received 2 ETH, which is likely used to pay for gas fees, consistent with the usage pattern of its other attack wallets.

Kalland noted that exactly two minutes later, the wallet used MetaMask's Gas Station service, even though there were already gas fees at that time. Three consecutive transactions appeared in the same block, including an ETH deposit from the Gas Station, an unlimited USDT authorization to the Kyber Network router, and a payment of 127.67 USDT to the Gas Station. The amount of this ETH deposit perfectly matched the maximum gas budget after combining the Kyber authorization and USDT payment, down to the wei.

Kalland stated that the ETH held by the wallet at that time was sufficient to cover the aforementioned fees, and it is reasonable to speculate that the user was using the MetaMask wallet and mistakenly selected USDT to pay for gas fees in haste. Using the MetaMask Gas Station requires going through MetaMask Sentinel, and the transaction is broadcasted by it rather than conventional RPC, meaning that the related interactions likely left off-chain records that may contain IP metadata. Among the attacker wallets examined, this is the only one that shows the use of the Gas Station, with the address 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.