Blockchain analytics firm Elliptic said Monday that the transaction patterns point to conventional software automation, with fixed timing, repeated transfer amounts and unsuccessful transactions being retried without meaningful changes in strategy.
The findings challenge speculation that autonomous AI agents are coordinating the movement of stolen assets across decentralized exchanges, lending protocols and blockchain bridges. The scale of the operation is substantial, but Elliptic said the evidence does not establish that software is making independent decisions.
The analysis follows the FBI’s October 31 attribution of the Binance attack to North Korea’s TraderTraitor hacking operation, which stole assets across 11 blockchains on October 29.
What Makes the Laundering Look Automated Rather Than AI-Driven?
Elliptic’s investigation identified transaction patterns consistent with software executing predefined instructions rather than autonomous systems adapting to changing conditions.
On the Tron network alone, the attackers conducted approximately 32,000 transactions, reaching a peak of 1,300 transfers in a single hour. At that rate, transactions occurred roughly every three seconds.
The main distribution wallet completed 1,113 transfers over 51 hours, dispersing stolen TRX through thousands of newly created addresses. Many transfers occurred at regular intervals, while receiving wallets frequently passed funds onward within minutes.
Investigators also observed failed transactions being retried and new laundering methods introduced in distinct stages, sometimes hours apart. Those characteristics are consistent with automated scripts operating under human supervision.
An autonomous AI agent might identify why a transaction failed, select a different destination or adjust its strategy without explicit human instructions. Elliptic has not observed evidence establishing that level of independent decision-making.
The distinction does not rule out undisclosed AI assistance. Blockchain transactions reveal movements of assets, not the software architecture or decision-making processes behind them.
Investor Takeaway
Conventional automation can already move billions through DeFi infrastructure at machine speed, creating significant challenges for transaction screening without requiring autonomous AI.
How Much of the $6.43 Billion Has Been Frozen?
Elliptic estimates that approximately $2.85 billion, or 44% of the stolen assets, has been frozen or seized. Around $3.24 billion remained in addresses linked to the theft as of November 2, predominantly in Bitcoin and Ether.
The initial response relied heavily on stablecoin issuers. Tether and Circle froze stolen USDT and USDC before the attackers could convert much of those holdings into cryptocurrencies without centralized freezing controls.
However, the hackers converted approximately $786 million in stablecoins before the restrictions took effect, including transactions through decentralized exchanges and collateralized borrowing arrangements.
Blockchain-level interventions also contributed to the containment effort. As previously reported, Arbitrum’s Security Council froze $30.5 million in assets linked to the breach through an emergency intervention.
Those actions restricted access to substantial funds, but freezing is not equivalent to recovering the assets or returning them to Binance.
Elliptic estimates that only a negligible amount of the stolen cryptocurrency has likely been cashed out. Most of the remaining assets are still identifiable on public blockchains, despite repeated transfers and conversions.
How Are Bridges and Lending Protocols Complicating Tracking?
The attackers have used at least seven cross-chain bridges to move assets between networks, often conducting small test transfers before sending larger amounts.
Tron became a major laundering route, with funds distributed across approximately 7,700 addresses before portions were bridged to Ethereum. Investigators identified at least $147 million transferred out of Tron through bridges.
The hackers also used decentralized lending infrastructure, including JustLend, to deposit cryptocurrency through one address and withdraw it through another. Such transactions can disrupt straightforward wallet-to-wallet tracing because the transfer occurs through a protocol rather than a direct payment.
Similar techniques were examined in FinanceFeeds’ earlier coverage of automated laundering following the Binance breach.
On November 1, investigators also detected the first use of Bitcoin mixing techniques. By early November 2, approximately 28 BTC, worth $2.2 million, had passed through 18 coinjoin transactions designed to obscure transaction histories.
Investor Takeaway
Cross-chain transfers and lending protocols increase the complexity of tracing stolen funds, making continuous monitoring more useful than static wallet blacklists.
Where Will the Stolen Funds Go Next?
Elliptic expects the attackers to continue converting Ether into Bitcoin before attempting to cash out through centralized exchanges and over-the-counter brokers, potentially over several months.
The firm cited the 2025 Bybit hack as a precedent, when North Korean attackers rapidly converted stolen Ether before gradually moving proceeds through suspected money laundering networks.
The FBI has urged exchanges, blockchain infrastructure providers and DeFi services to block transactions involving identified TraderTraitor wallets. Elliptic said its monitoring systems now associate more than 9,500 addresses with the Binance theft.
The immediate challenge is preventing stolen assets from reaching services capable of exchanging cryptocurrency for spendable funds. Although investigators have traced much of the activity, the absence of evidence for autonomous AI decision-making does little to reduce the operational threat posed by automated laundering at this scale.
