Elliptic Finds No Sign of AI Agents Behind the Binance Hack Laundering

Blockchain analytics firm Elliptic says the North Korean hackers behind the $6.4 billion Binance theft do not appear to have used AI to hide the money. In under three days, the attackers pushed stolen funds through roughly 20 automated services, including decentralized exchanges, lending protocols and cross chain bridges. Co-founder and chief scientist Tom Robinson described the activity as automated but said nothing points to an AI agent making choices. In his view, the pattern fits scripts written and overseen by people.

How Elliptic Tells Scripts From AI Agents

An AI agent can adjust on its own, for instance by picking a new bridge or exchange when a payment fails or a wallet gets blocked. Elliptic did not see that. Failed transfers were simply sent again, the same amounts kept showing up, and small test payments came before larger ones. Six bridges were first used within a 100-minute window on Oct. 30, though the firm says it cannot tell whether a person or a machine chose them.

Frozen Funds and What the Hackers Still Hold

The FBI has tied the Oct. 29 attack to North Korea’s TraderTraitor group and asked crypto services to block wallets linked to the loot. Even so, the attackers still control about $3.28 billion spread across more than 950 wallets. Elliptic puts the frozen or seized total at $2.85 billion, which is 44% of the stolen amount.