[Binance Hackers Suspected of Making a Mistake; IP May Be Located Through MetaMask Gas Station] Odaily Planet Daily reports that smart contract developer Justin Kalland posted on X that Binance hackers appear to have made a potential mistake, as MetaMask should have preserved as much Web2 log as possible. Specifically, the hackers sent 175 million USDT to a new wallet, and approximately 2.5 minutes later, the wallet also received 2 ETH. This was likely used to pay gas fees, consistent with the pattern used in their other attacks on wallets. Exactly two minutes later, the wallet used MetaMask's Gas Station service, even though it already had gas fees. Three consecutive transactions appeared in the same block—an ETH deposit from the Gas Station, an unlimited USDT authorization to a Kyber Network router, and a payment of 127.67 USDT to the Gas Station. The amount of the ETH deposit perfectly matches the maximum gas budget combined with the Kyber authorization and USDT payment. Precise to the wei (the smallest unit of Ethereum). However, the problem is that they had more than enough ETH to cover both fees at the time. Therefore, a reasonable assumption is that they were using a MetaMask wallet and, in their haste, mistakenly selected USDT to pay the gas fees. For convenience, MetaMask sometimes defaults to this method, and the order of deposits within the same block aligns with its implementation mechanism. To use Gas Station in MetaMask, users must use MetaMask Sentinel. This means transactions are broadcast through them, not via regular RPC. This interaction likely leaves off-chain records in MetaMask, potentially including IP metadata. Of all the attackers' wallets examined, this is the only one showing the use of Gas Station: 0xAa246BF639586a6Ba46762D378CE50cA4fc654a0.