Blockchain analytics firm Elliptic reported that there is no evidence artificial intelligence (AI) was used by cybercriminals to launder $6.4 billion stolen during the Binance hack. Investigators concluded that the laundering process relied on automated scripts under human supervision, rather than self-directing AI agents.
Methodical fund movements and automation
The hack, attributed by the FBI to North Korea’s TraderTraitor hacking group, was marked by the rapid transfer of funds. Within three days, the criminals moved the stolen assets using about 20 automated services, primarily routing the funds through decentralized exchanges, lending protocols, and cross-chain bridges. This swift activity initially raised concerns that AI-driven agents could have been involved in dynamically selecting routes for the stolen money.
However, Tom Robinson, co-founder and chief scientist at Elliptic, stated the observed behaviors aligned with conventional automated scripts. He noted that each transaction step looked to be following predetermined instructions set by humans, rather than the adaptive choices expected from an AI system.
“Our assessment is that the laundering is automated, but nothing we have seen shows an AI agent making decisions. The pattern fits scripts written and supervised by people,” Robinson stated.
AI agents typically can adapt quickly to obstacles, altering plans if a transaction fails or a wallet is blocked. Elliptic found no such signs of adaptive behavior in the post-hack laundering, observing repeated transfers, recurring transaction amounts, and test transactions before larger fund movements—hallmarks of static code rather than responsive AI decision-making.
FBI and Elliptic findings
The FBI confirmed that on October 29, the TraderTraitor group orchestrated the attack and subsequently began shifting the funds rapidly across various platforms. US authorities called on cryptocurrency service providers to block transfers associated with wallets tied to the compromised assets.
Elliptic’s analysis focused on how the group managed to continue shifting funds even after asset freezes were put in place. While six cross-chain bridges were used within just 100 minutes on October 30, the firm could not determine whether these particular services were selected by humans or through AI-based automation.
Elliptic described how failed swap attempts and repeated transactions indicate that scripts, not intelligent agents, managed the laundering. Had AI been involved, the laundering process would likely have adapted to interruptions, finding alternative paths rather than submitting the same failed transactions.
Mini dictionary: Elliptic is a London-based blockchain analytics company that provides anti-money laundering, forensic investigation, and compliance solutions for digital assets.
Status of seized and remaining funds
Elliptic reported that out of the original $6.4 billion in stolen digital assets, approximately $2.85 billion—or 44%—has been frozen or seized through law enforcement and exchange interventions. The hackers still retain control of around $3.28 billion, distributed among more than 950 wallets.
| Status | Amount (USD) | Percentage |
|---|---|---|
| Frozen or seized | $2.85 billion | 44% |
| Still under hacker control | $3.28 billion | 56% |
| Total stolen | $6.4 billion | 100% |
Elliptic emphasized that the frozen funds consist largely of stablecoins, while the hackers continue to manage significant sums via hundreds of addresses across multiple blockchains.
Elliptic concluded that, given the evident transaction patterns and absence of adaptive tactics, the group’s approach aligns with human-supervised scripts rather than truly autonomous AI-driven methods.
