Analysis: Suspected Binance Attacker Mistakenly Used MetaMask Gas Station, Possibly Leaving Traceable Records

October 30: Protocol engineer Justin Kalland posted that the Binance attacker may have made an operational mistake. The attacker transferred 175 million USDT to a new wallet, and about 2.5 minutes later the wallet received 2 ETH for gas, matching the pattern of their other attack wallets. Another two minutes later, the wallet used MetaMask's Gas Station despite already having sufficient gas. Three consecutive transactions were bundled into the same block: the ETH top-up for Gas Station, an unlimited USDT approval to the Kyber Network router, and a payment of 127.67 USDT to Gas Station. The ETH top-up amount exactly equaled the sum of the maximum gas budgets of the latter two transactions, down to the wei.

Kalland speculates that the attacker was using a MetaMask wallet at the time and, in a hurry, mistakenly selected USDT as the gas payment method. MetaMask sometimes defaults to this, and the ordering of the top-up within the same block also matches how it is implemented. He pointed out that using Gas Station requires going through MetaMask Sentinel, with transactions routed through MetaMask rather than a regular RPC, and that this interaction may have left off-chain records at MetaMask, including IP metadata. Of all the attacker wallets he examined, this is the only one that showed use of Gas Station.