Protocol engineer Justin Kalland said a suspected Binance attacker may have made an operational mistake that could leave a traceable record. According to his post, the attacker moved 175 million USDT into a fresh wallet. About 2.5 minutes later, that wallet received 2 ETH for gas, matching a pattern seen in the attacker’s other wallets. Roughly two minutes after that, the same wallet used MetaMask’s Gas Station even though it already had enough ETH to cover fees.
Kalland said three back-to-back transactions landed in the same block: an ETH top-up to Gas Station, an unlimited USDT approval to the Kyber Network router, and a 127.67 USDT payment to Gas Station. He noted that the ETH top-up exactly matched, down to the wei, the combined maximum gas budget of the latter two transactions. Based on that sequence, he speculated the attacker was using MetaMask and accidentally selected USDT as the gas payment asset in a rushed moment. He added that using Gas Station requires MetaMask Sentinel, meaning the transaction flow would pass through MetaMask rather than a standard RPC endpoint, which could leave off-chain records including IP metadata. He also said this was the only attacker wallet he reviewed that showed Gas Station usage.
PANews reported on Oct. 30 that protocol engineer Justin Kalland said the Binance attacker may have made an operational mistake.
In his account, the attacker sent 175 million USDT to a new wallet. About 2.5 minutes later, that wallet received 2 ETH for gas, a pattern he said matched the attacker’s other wallets. Roughly two minutes later, the wallet used MetaMask’s Gas Station despite already having enough gas.
Three transactions were packed into the same block
Kalland said three consecutive transactions were included in the same block: an ETH top-up for Gas Station, an unlimited USDT approval for the Kyber Network router, and a 127.67 USDT payment to Gas Station.
He said the ETH top-up amount exactly matched, down to the wei, the combined maximum gas budget for the latter two transactions.
Possible mistaken gas payment selection in MetaMask
Kalland speculated that the attacker was using a MetaMask wallet and, in a rushed moment, mistakenly selected USDT as the asset to pay for gas. He said MetaMask sometimes defaults to that setup, and the ordering of the top-up within the same block also fits how the feature is implemented.
Interaction may have left off-chain records
He added that using Gas Station requires MetaMask Sentinel, so the transaction would pass through MetaMask rather than a standard RPC endpoint. That interaction may have left off-chain records at MetaMask, including IP metadata.
According to Kalland, this was the only wallet among all the attacker wallets he reviewed that showed Gas Station usage.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
