Binance attacker may have misused MetaMask Gas Station; related actions may have left off-chain records

TechFlow reported on Oct. 30 that smart contract developer Justin Kalland said the Binance attacker, after transferring 175 million USDT to a new wallet, received 2 ETH about 2.5 minutes later, apparently to pay gas fees. The wallet then still used MetaMask Gas Station despite having sufficient ETH, completing three consecutive transactions in the same block: ETH replenishment, an unlimited USDT approval for KyberNetwork Router, and payment of 127.67 USDT to Gas Station.

Justin Kalland noted that the amount of ETH replenished by Gas Station exactly equaled the total maximum gas budget of the latter two transactions, down to the Wei. He speculated that the attacker may have mistakenly selected USDT as the gas payment asset while using MetaMask Wallet. Because MetaMask Gas Station requires transactions to be processed through MetaMask Sentinel, the related interactions may have left off-chain records in MetaMask, including metadata such as IP addresses. Among the attacker wallets he has examined, only this address shows use of Gas Station.

Source: TechFlow