Binance Attacker May Have Misused MetaMask Gas Station, Related Operations Could Leave Off-Chain Records

According to TechFlow, on October 30, smart contract developer Justin Kalland stated that after the Binance attackers transferred 175 million USDT to a new wallet, they received approximately 2 ETH about 2.5 minutes later, likely intended to cover gas fees. However, the wallet subsequently used MetaMask Gas Station despite already having sufficient ETH, executing three transactions consecutively within the same block: topping up ETH, granting unlimited USDT allowances to the KyberNetwork Router, and paying 127.67 USDT to the Gas Station.

Justin Kalland noted that the amount of ETH topped up by the Gas Station exactly equaled the sum of the maximum gas budgets for the latter two transactions, down to the wei. He speculated that the attackers may have accidentally selected USDT as the gas payment asset while using the MetaMask Wallet. Since the MetaMask Gas Station processes transactions through MetaMask Sentinel, these interactions could leave off-chain records within MetaMask, including metadata such as IP addresses. To date, among the attacker wallets he has examined, only this address shows evidence of having used the Gas Station.