Is my money on Binance safe? Check transfers before acting on the MetaMask clue

What the new wallet report says

Odaily's October 30 report, timestamped 07:58:56 SGT, attributes the analysis to developer Justin Kalland. It describes 175 million USDT arriving at a new wallet, followed about two and a half minutes later by 2 ETH. The report then describes use of MetaMask's Gas Station service about another two minutes later. These are the analyst's reported observations, rather than transactions independently reconstructed by NexuAlpha.

The reported sequence included an ETH top-up, an unlimited USDT approval for a Kyber Network router and a payment of 127.67 USDT to the gas service in the same block. Kalland interpreted the combination as a possible trace of wallet software use. The inference that service records could help identify the operator is still an inference. PANews's account of the same analysis.

ChainCatcher also reports Kalland's argument. Its coverage gives readers another account to compare, but the underlying investigator is the same. Three publishers carrying that analysis do not constitute three independent reconstructions of the wallet. None of the opened reports establishes that an IP address has been obtained, that a person has been identified or that customer money has been returned. ChainCatcher's report.

Why paying gas in USDT is not proof of an attack

MetaMask's current help page explains that its gas-included transactions allow users to cover network fees using an eligible token instead of the network's native asset. It also explicitly says a user who already holds enough native gas can choose a different token to pay. That makes the feature's existence consistent with the reported sequence, but it cannot authenticate the analyst's attribution of a particular wallet. MetaMask's gas-included transaction guide.

A customer seeing a similar fee option should therefore read the transaction being requested. A gas-payment option by itself says nothing about whether a website is entitled to receive funds. Check the token, recipient, network and requested permission before signing. Do not approve an unfamiliar contract merely because its fee display resembles a legitimate wallet feature.

The practical distinction is between understanding a transaction and accepting its purpose. A wallet can display a technically valid request from a site that has no legitimate reason to move your assets. For this incident, the reader's task is to inspect their own requests, not to reproduce the suspected operator's route or send a trial payment to one of the reported addresses.

Check the withdrawal you already requested

Open the app you normally use directly. Find the existing withdrawal in your account history and save its asset, network, amount, destination, request time and displayed status. If a transaction identifier is shown, preserve it alongside the exchange's order record. Record exactly what the interface says; “processing,” “failed” and “completed” should not be rewritten as the same outcome in a support request.

Use those records to ask a specific question through support reached from the app: has this request been broadcast, rejected or held for review? This is a recommended evidence checklist, not a claim that every customer currently sees the same interface or that a particular network is operating. No live customer account was accessed for this article.

A delay does not, on its own, tell you its cause. Binance's general anti-scam help page describes account-level withdrawal restrictions and tells users with unresolved issues to contact support with transaction details. That standing guidance is not an incident recovery timetable. Do not apply a duration mentioned in an ordinary help article to today's exchange-wide event. Binance's withdrawal anti-scam guidance.

Keep the account record and any on-chain record together. If you contact support again, refer to the same withdrawal and existing case rather than creating a different story from each social headline. A record with a clear destination and status is more useful than a screenshot of a large exchange-wide outflow number.

Do not move funds to a wallet supplied by a stranger

Binance's anti-scam guidance describes impersonators claiming that an account is compromised and offering a “safe wallet.” The exchange says it will not ask customers to move assets to such a wallet to secure them. Treat a recovery phrase or receiving address supplied through an unsolicited call or message as a reason to stop the interaction.

Apply that check to messages labelled “Binance compensation,” “refund verification” or “emergency migration.” These are examples of claims to scrutinize, not a statement that the exchange has opened any such programme. Reach official support independently through the app. Do not enter an account password, authentication code or wallet recovery phrase into a page reached from a direct message.

A demand to send crypto before a payout is another reason to stop. The same Binance help page describes fake giveaways that require an initial deposit. There is no verified customer compensation process in this article's opened incident sources. A stranger's promise does not become official because it includes the correct incident amount or a familiar company logo.

Self-custody requires a different permission check

If you use a self-custody wallet, inspect connected applications separately from your exchange account. MetaMask's permissions guide says users can review connected applications in the Permissions screen and remove a connection. It also warns that disconnecting an application does not revoke token approvals: an application may still be able to move previously approved tokens. MetaMask's permissions guide.

That distinction matters when a supposed recovery page asks you to connect a wallet. Closing the browser tab or disconnecting after signing should not be treated as proof that an authorization has disappeared. Review what was signed and identify the token and spender involved before deciding how to address an unwanted approval. Use the wallet's own help route for the relevant approval controls.

Do not import a recovery phrase supplied by someone else as an emergency destination. Do not paste your own phrase into a support form. If you decide to use a receiving wallet you control, verify its address and network independently of the person urging you to transfer. This is a custody checklist; it does not imply that withdrawing is currently available or that a move is necessary for every customer.

What a reserve figure cannot answer for your transfer

Keep reserve research separate from your immediate transfer record. Ask when a reserve statement was measured, which assets and liabilities it covers and whether it answers the question you are asking. A historical balance measurement and the current status of one withdrawal are different observations. Neither should silently substitute for the other.

We could not read Binance's live proof-of-reserves page during this run: the fetch returned an empty challenge response. We therefore use no current reserve ratio, balance figure or coverage claim here. An unverified reserve number would not help a customer resolve a specific pending request. The next useful record is the exchange's status for that request and any corresponding transaction identifier.

Keep market exposure separate from access to funds

A customer may be checking an exchange balance while also carrying an open position. Review pending transfers and trading exposure as separate tasks. If you use NexuAlpha's liquidation board, inspect the displayed observation period and venues before comparing it with a headline about the incident. A changing market total does not identify whose withdrawal is pending.

Use the funding board to examine the contract and timestamp relevant to your position. Do not assume that a funding reading, a token price move or a market liquidation figure establishes the size of stolen funds. We do not reconstruct an incident-window liquidation total from a later dashboard snapshot in this article.

What would change this assessment

For the investigative lead, the missing evidence is a verified link between the reported transactions, the service provider's records and an identified actor. For customers, the missing evidence is a dated incident statement explaining affected services and a status for their own request. Neither gap is filled by counting how many sites repeat the same analyst.

Save later updates with their publication times in SGT. Compare each statement with the earlier one before treating it as a new fact: does it change the incident classification, a recovery amount, a service's availability or your withdrawal's status? A technical hypothesis can help investigators decide where to look while still leaving those customer questions unanswered.

Quick answers

Has the gas-service lead identified the operator?

No identification is established by the opened reports. They describe one developer's hypothesis about a transaction pattern and possible service records.

Does disconnecting a dapp remove its token permissions?

MetaMask says disconnecting does not revoke token approvals. Review the authorization separately instead of assuming that closing a connection removed it.

Should I pay to unlock compensation?

No verified compensation process is established here. Binance's anti-scam guidance describes fake giveaways requiring an initial deposit. Independently open official support before acting on any payout claim.