Developers say that the Binance hacker may have made a mistake and could potentially be located through MetaMask IP

Smart contract developer Justin Kalland posted on X, indicating that the Binance hacker may have made a potential mistake, and MetaMask should retain any Web2 logs it can access as much as possible. He stated that the hacker sent 175 million USDT to a new wallet, and about 2.5 minutes later, that wallet received 2 ETH, likely used to pay for gas fees, which aligns with the usage pattern of other attack wallets.

Kalland noted that exactly two minutes later, the wallet used MetaMask's Gas Station service, even though there were already gas fees at that time. Three consecutive transactions appeared in the same block, including an ETH deposit from the Gas Station, an unlimited USDT authorization to the Kyber Network router, and a payment of 127.67 USDT to the Gas Station. The amount of this ETH deposit perfectly matched the maximum gas budget after combining the Kyber authorization and USDT payment, down to the wei.

Kalland stated that the ETH held by the wallet at that time was sufficient to cover the aforementioned fees, reasonably inferring that the user was using the MetaMask wallet and mistakenly selected USDT to pay for gas fees due to haste. Using the MetaMask Gas Station requires going through MetaMask Sentinel, and the transaction is broadcasted by it rather than through conventional RPC, meaning that related interactions likely left off-chain records that may contain IP metadata. Among the checked attacker wallets, this is the only one that showed the use of the Gas Station, with the address 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.