The Binance hacker may have made an error, smart contract developer Justin Kalland said, urging MetaMask to preserve any available Web2 logs. A wallet that received 175 million USDT from the hacker used MetaMask's Gas Station despite already holding enough ETH for the transaction fees. The interaction likely generated off-chain records at MetaMask that may contain IP metadata, potentially allowing the hacker to be located.