Ada Crow

A potential slip by the Binance attacker? @MetaMask should preserve whatever web2 logs they can. The attacker sent 175M USDT to a fresh wallet. About 2.5 minutes later, that wallet also received 2 ETH. Likely for gas, matching the pattern used with their other attack wallets. Exactly two minutes after that, it used MetaMask's Gas Station. Despite already having gas. Three consecutive transactions landed in the same block: an ETH top-up from Gas Station, an unlimited USDT approval for @KyberNetwork's router, and a payment of 127.67 USDT to Gas Station. The ETH top up exactly matched the combined maximum gas budgets of the Kyber approval and the USDT payment. Down to the wei. But they already had more than enough ETH to cover both. My theory: they were using MetaMask Wallet and, while rushing, selected USDT for gas by mistake MetaMask sometimes defaults like this for convenience. And the same block top-up sequence matches how their implementation works. To use Gas Station in MetaMask you have to use MetaMask Sentinel. Meaning the transactions go through them, not a regular RPC. That interaction probablly left offchain records with MetaMask, potentially including IP metadata. Among all the attacker wallets I checked, this was the only one showing Gas Station usage. The wallet: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0