No evidence AI was used by North Korean hackers to launder Binance theft
Analysts say the $6.4 billion Binance hack was automated, but not driven by artificial‑intelligence agents.
Investigators of the $6.4 billion Binance hack have found no evidence that the cybercriminals used artificial intelligence (AI) to launder the loot.
The North Korean hackers moved stolen funds through roughly 20 automated software services in less than three days, using decentralized exchanges, lending protocols and cross‑chain bridges, blockchain analytics firm Elliptic said on Monday.
Elliptic co‑founder and chief scientist Tom Robinson said the activity raised questions about whether AI agents were choosing where and how to move the money, but the transactions “look more like conventional software following instructions set by humans.”
Key observations
The laundering is automated, yet no AI‑driven decision‑making was observed; the pattern fits scripts written and supervised by people.
Repeated transfers and failed transactions resemble scripts carrying out preset instructions, rather than an AI adapting to failures.
Hackers reused the same transaction amounts and tested new routes with small transfers before moving larger sums.
Six cross‑chain bridges were first used within a 100‑minute period on Oct. 30, but Elliptic said the evidence does not establish whether humans or AI systems selected those services.
Despite billions of dollars in stolen stablecoins being frozen, the hackers still control about $3.28 billion spread across more than 950 wallets. Elliptic said $2.85 billion, or 44 % of the stolen funds, has been frozen or seized.
Most of the remaining assets are held in bitcoin and ether, which a central issuer cannot freeze, and a negligible amount appears to have been converted into cash.
Elliptic also identified about $16 million sent to addresses holding proceeds from September’s Bitget exploit, suggesting the same laundering operation is handling funds from both attacks.
Elliptic has not ruled out AI involvement entirely, but said the examined transactions could have been carried out by scripts written and monitored by people.
The FBI confirmed the Oct. 29 theft was carried out by North Korea’s TraderTraitor hacking group and asked cryptocurrency services to block transactions involving wallets linked to the stolen funds.
Read all of CoinDesk’s coverage of the Binance hack here.
