Odaily reported that smart contract developer Justin Kalland said in a post on X that a suspected Binance hacker may have made a mistake, and MetaMask should preserve any Web2 logs it may have collected.
Kalland said the attacker sent 175 million USDT to a fresh wallet. About 2.5 minutes later, that wallet received 2 ETH. He said the ETH was likely meant to cover gas fees, matching a pattern seen in the attacker’s other wallets.
Two full minutes later, however, the wallet used MetaMask’s Gas Station service even though it already had enough ETH to pay for gas.
Three consecutive transactions appeared in the same block
According to Kalland, three back-to-back transactions landed in the same block:
- an ETH top-up from Gas Station,
- an unlimited USDT approval to the Kyber Network router,
- and a 127.67 USDT payment to Gas Station.
He said the ETH top-up amount matched the maximum gas budget for the Kyber approval and the USDT payment combined, exactly down to the wei.
Kalland says USDT may have been selected for gas by mistake
The issue, he wrote, is that the wallet already held enough ETH to pay for both transactions. Based on that, Kalland said the most reasonable explanation is that the operator was using a MetaMask wallet and, in a rush, accidentally chose to pay gas in USDT. He added that MetaMask sometimes defaults to that option for convenience, and the order of the top-up within the same block also fits how the mechanism works.
Interaction may have left off-chain records
Kalland also said that using Gas Station in MetaMask requires MetaMask Sentinel. That means the transaction would have been broadcast through that system rather than through a standard RPC endpoint.
In his view, that interaction likely left off-chain records at MetaMask, and those records may include IP metadata.
Among all attacker wallets he reviewed, Kalland said this was the only one that showed use of Gas Station. The wallet address is 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.
