A suspected Binance attacker may have misused MetaMask to pay gas fees or left off-chain logs.

Protocol engineer Justin Kalland analyzed that the suspected Binance attacker, after transferring 175 million USDT, may have left off-chain logs containing information such as the IP address by mistakenly paying 127.67 USDT in gas through MetaMask Gas Station. Kalland called on MetaMask to retain relevant Web2 logs; the address involved is 0xAa24…54a0.