CoinDesk
Elliptic found no evidence that AI directed the laundering of funds stolen in the $6.4 billion Binance hack. The firm said the North Korean hackers used about 20 automated services in less than three days, with transaction patterns more consistent with human-supervised scripts than decision-making AI agents. About $2.85 billion, or 44% of the stolen funds, has been frozen or seized; the hackers still control about $3.28 billion across more than 950 wallets.
Why it matters
The distinction is between automation and autonomy. Scripts can execute preset instructions, while AI agents can make decisions and change course when a transaction fails or a wallet is blocked. Elliptic said it has not observed that adaptive behavior in the Binance transactions.
Repeated transfers, failed swaps and reused transaction amounts fit the pattern of scripts carrying out instructions. The hackers also tested routes with small transfers before moving larger sums. Six cross-chain bridges were first used within a 100-minute period on Oct. 30, but Elliptic said the evidence does not establish whether humans or AI systems selected them.
Market impact
The FBI attributed the Oct. 29 theft to North Korea’s TraderTraitor hacking group and urged crypto services to block transactions involving wallets linked to the stolen funds. The post-theft movements crossed decentralized exchanges, lending protocols and cross-chain bridges, creating multiple points for services to identify and freeze funds.
The scale of the remaining balance keeps the focus on wallet monitoring and coordination across crypto services. Elliptic’s assessment addresses how the funds were moved; it does not change the amount still controlled by the hackers or establish who chose each route.
Frequently asked questions
-
What evidence led Elliptic to describe the laundering as script-driven?
Elliptic cited repeated transfers, failed transactions and reused amounts. The hackers also tested routes with small transfers before moving larger sums.
-
How much of the stolen money has been frozen or seized?
About $2.85 billion, equal to 44% of the stolen funds, has been frozen or seized.
-
How much do the hackers still control?
They still control about $3.28 billion spread across more than 950 wallets.
-
What was the significance of the bridge activity on Oct. 30?
Six cross-chain bridges were first used within a 100-minute period. Elliptic said the evidence does not establish whether humans or AI systems selected them.
-
Which group did the FBI link to the Binance theft?
The FBI attributed the Oct. 29 theft to North Korea’s TraderTraitor hacking group and asked crypto services to block transactions involving linked wallets.
WuBlockchain
CoinTelegraph
Lookonchain
CryptoSlate