Nov 2, 2026, 6:57 a.m. EST
2 min read
Summary
- Elliptic discovered no proof that artificial intelligence guided the laundering of capital taken during the $6.4 billion Binance breach, stating the operations resembled human-managed scripts.
- The FBI blamed the October 29 breach on North Korea’s TraderTraitor cyber syndicate, which utilized roughly 20 automated programs to transfer stolen money in under 72 hours.
- Roughly $2.85 billion, representing 44 percent of the pilfered assets, has been locked or confiscated, while the attackers maintain command over approximately $3.28 billion spread across more than 950 addresses.
Forensic experts examining the $6.4 billion Binance security breach have uncovered zero proof that the malicious actors utilized artificial intelligence to launder the stolen capital.
The North Korean cyberattackers employed about 20 automated software protocols within a span of less than three days, transferring the pilfered funds through cross-chain bridges, decentralized trading platforms, and lending mechanisms, according to a Monday statement by blockchain intelligence organization Elliptic.
This behavior sparked inquiries regarding whether autonomous AI agents were determining the destinations and methods for moving the capital, but Elliptic co-founder and chief scientist Tom Robinson stated that the transfers presently appear more akin to traditional software executing predefined human directives.
Our evaluation indicates that the laundering process is automated, but nothing we have observed points to an AI agent making autonomous choices. The behavior aligns with scripts drafted and overseen by people.
Autonomous AI entities possess the capability to evaluate situations and alter courses independently without requiring human oversight for every individual phase. Such capability could entail discovering an alternative bridge or exchange when a transfer fails or an address gets blacklisted. Elliptic reported that it has not detected that category of action within the Binance transactions.
Read all of CoinDesk’s coverage of the Binance hack here.
The FBI verified the October 29 intrusion was executed by the North Korean TraderTraitor hacking collective and urged cryptocurrency platforms to freeze transactions tied to addresses associated with the stolen assets.
The newest insights from Elliptic investigate events following the security breach, including how the attackers transferred capital that managed to evade the initial asset freezes and whether artificial intelligence played a role.
Elliptic noted that the repetitive transactions and unsuccessful transfers bear a strong resemblance to scripts executing predetermined instructions. An autonomous AI agent might have recognized the underlying cause of a failed transfer and attempted an alternative approach rather than simply resending the identical transaction. Furthermore, the attackers utilized consistent transfer amounts and tested novel pathways utilizing modest sums prior to shifting larger quantities, based on Elliptic’s findings.
Six cross-chain bridges were initially engaged inside a 100-minute window on October 30, though Elliptic clarified that the available evidence fails to confirm whether human operators or AI architectures chose those specific platforms.
Despite billions of dollars worth of pilfered stablecoins being locked down, the attackers continue to manage nearly $3.28 billion distributed across in excess of 950 distinct wallets. Elliptic stated that $2.85 billion, equating to 44% of the stolen capital, has been secured or blocked.
Read more: Binance loses over $6 billion in ‘biggest crypto hack in history’
Originally published at https://www.coindesk.com/tech/2026/11/02/no-proof-of-ai-in-north-korean-hackers-move-of-stolen-binance-funds-through-thousands-of-wallets.
