Elliptic Finds No AI Laundering in Binance Hack

Elliptic’s latest forensic sweep of the $6.4 billion Binance breach finds no trace of autonomous artificial‑intelligence agents steering stolen funds. The analysis, released Monday, points instead to a series of scripted, pre‑programmed transfers that moved assets through dozens of blockchains, DeFi protocols and bridges at machine speed. The finding matters because it removes speculation that the scale of the theft could only be achieved by a self‑learning system, and it clarifies the nature of the laundering routes that law‑enforcement and exchanges are now blocking.

The hack began on October 29, when a breach of Binance’s hot wallets drained more than $6 billion from ten blockchains in a matter of minutes. The FBI’s alert on October 31 identified the attackers as the TraderTraitor group, a subdivision of the Lazarus‑affiliated unit that has been linked to earlier high‑profile thefts such as the Bybit and Bitget incidents. The bureau’s notice urged exchanges, node operators and DeFi platforms to refuse transactions involving the hundreds of addresses supplied in the alert.

Media additions

FBI blames North Korea for $6 billion Binance hack, urges THORChain to block stolen funds

Elliptic’s investigation, sourced from Financefeeds, examined transaction logs across Tron, Ethereum, Solana and other networks. The firm noted that the attackers performed about 32 000 Tron transfers, peaking at 1 300 swaps in a single hour, and that the main distribution wallet executed 1 113 transfers over 51 hours. Many of the movements followed a strict cadence: a new address received exactly one TRX, then larger amounts, and the funds were passed on within minutes. The pattern is typical of automated scripts that repeat a fixed set of instructions rather than a system that adapts to changing conditions.

Elliptic also identified repeated attempts to clear failed transactions by retrying them with the same parameters, a hallmark of a script that simply re‑issues a command when the blockchain rejects it. The firm concluded that the evidence does not support the presence of an autonomous agent that would modify its strategy in real time. While the analysis does not rule out the use of AI for planning the attack, it shows that the actual movement of assets was carried out by conventional software.

Other analytics firms have highlighted similar automation. Cryptoslate reports that Chainalysis tracked the theft and observed the attackers converting stolen assets into Ethereum before moving them through DeFi lending protocols on Tron. The firm noted that the hackers had transferred about $500 million in stablecoins and $325 million into ETH within a 20‑minute window, preceding the first coordinated freezes. Chainalysis also documented that the attackers repeatedly circulated funds between new addresses, a practice that makes tracing more difficult.

A technical glitch on Thorchain’s cross‑chain bridge further disrupted the laundering route. Bitcoin.com describes how a one‑block Ethereum reorganisation caused Thorchain to issue a double refund of 10 ETH, triggering an emergency pause that halted swaps on 12 of the 13 supported networks. The pause, lasting a few hours, temporarily blocked the route that hackers had been using to move stolen ETH into other blockchains. The incident illustrates how a protocol’s built‑in safety checks can unintentionally impede illicit flows, even though the freeze was not a targeted asset‑level intervention.

Binance’s own response has been swift. The exchange announced that it had covered 90 % of the loss from its SAFU reserve and corporate funds, and that it would resume withdrawals in phases, starting on November 1. The company’s withdrawal schedule shows that the first phase opened for major cryptocurrencies across 15 networks, including Bitcoin, Ethereum, Solana and Tron. By the end of that phase, Binance had processed $3.64 billion in net outflows, a figure that underscores the scale of the recovery effort. The exchange also released a cryptographic proof of reserves on November 2, confirming that client balances are fully backed.

The frozen assets have come from multiple sources. According to Elliptic, Tether and Circle froze the majority of the stolen stablecoins before the attackers could convert them. The firm estimates that 2.85 billion, or 44 % of the total theft, has been frozen or seized. Chainalysis reports that about 2.8 billion has been locked by issuers and protocol‑level interventions, leaving roughly 3.2 billion still in the hands of the attackers. The remaining assets are spread across Bitcoin, Ether, XRP and TRX, and most have been moved through automated scripts that keep them in transit.

Despite the freezing efforts, the FBI’s alert remains a key tool for law‑enforcement. Unchainedcrypto notes that the bureau’s list contains 608 Ethereum addresses, 19 Bitcoin wallets and one Solana address. The alert urges exchanges and node operators to block any transactions involving those addresses or funds derived from them. The list is meant to stop the laundering process before the attackers can move the assets into fiat‑backed exchanges or over‑the‑counter desks.

The incident also highlights the limits of “freezing” in a decentralized environment. As Kancelaria Prawna Skarbiec explains, a freeze at the issuer level can only stop the movement of tokens that the issuer controls. Tokens that have already been bridged to other chains or deposited into DeFi protocols remain outside the reach of centralised controls. The analysis points out that while the freezing of stablecoins and the emergency pause on Thorchain disrupted the flow, the attackers still retain the ability to move the remaining assets through other channels.

What to Watch Next

• Binance’s scheduled return of the remaining 5 % of reserves, expected in the next few weeks.
• Ongoing monitoring of the 600+ addresses supplied by the FBI for any new movements.
• Potential legal actions against the TraderTraitor group, should evidence of further laundering emerge.

In the days ahead, exchanges and protocol operators will continue to enforce the block list issued by the FBI, while regulators press for clearer rules on freezing assets that have already exited the control of centralized issuers. The Elliptic report, by clarifying that the laundering was carried out by scripts rather than autonomous AI, provides a more realistic picture of the threat landscape and shows how much rapid, coordinated responses to large‑scale thefts.