Blockchain analysis firm Elliptic has concluded that the massive $6.4 billion cyberattack on Binance did not involve artificial intelligence in laundering the stolen assets. While the attackers automated their transactions, the observed patterns suggest human-supervised software played a central role.
Rapid Movement Across Multiple Services
Elliptic reported that the North Korea-linked attackers utilized approximately 20 automated software services in under three days. The funds were moved through decentralized exchanges, lending protocols, and cross-chain bridges. Initially, this rapid movement raised the possibility of AI-supported decision-making, but the transactional flow failed to provide any definitive evidence of such involvement.
Renowned for tracking illicit fund movements on the blockchain, Elliptic’s investigation scrutinized thousands of transfers, failed swap attempts, and repeated transaction trials.
“The laundering process was automated, yet no data showed that an AI agent made the decisions. The scenario aligns more closely with scripts written and monitored by humans,” stated Tom Robinson, co-founder of Elliptic.
Script-Like Recurrences Raise Questions
According to the firm’s findings, the recurring transfers and failed transactions suggest the use of scripts following predefined instructions. A more advanced AI might attempt alternative routes when faced with failures, whereas the analyzed behavior showed repeated submissions of the same transactions.
The investigation also revealed that attackers tested new pathways with small amounts before executing larger transfers. Furthermore, on October 30, six different cross-chain bridges were activated within a 100-minute timeframe. Despite these indicators, Elliptic could not definitively determine whether humans or another automation system chose these services.
Elliptic noted the absence of autonomous redirection behavior expected from an AI agent within the Binance transactions, highlighting that current data points to more limited automation.
FBI Links Attack to TraderTraitor Group
The U.S. Federal Bureau of Investigation has confirmed that the October 29 theft was executed by North Korea’s hacker group, TraderTraitor. The agency urged cryptocurrency service providers to block wallets associated with the stolen funds.
Elliptic’s latest assessment scrutinizes how the assets, evading initial freezes, were moved and whether AI played any role in this process. So far, $2.85 billion, which accounts for 44% of the stolen funds, has been frozen or recovered.
Billions Remain Under Attackers’ Control
Despite rapid interventions by stablecoin issuers and crypto platforms, approximately $3.28 billion in assets remain across over 950 wallets under the attackers’ control. This underscores the ongoing effort to track the remaining funds amid swift responses by the crypto community.
