Binance hack: no artificial intelligence behind the laundering of $6.4 billion

Old-fashioned bleaching. On October 29, the Binance hack caused $6.4 billion to disappear, the largest hack in history. Since then, the pace of transfers has fueled a question: did artificial intelligence choose where and how to move this loot? On Monday, November 2, blockchain analysis firm Elliptic looked into the matter, and nothing in the transactions studied showed AI in control.

The key points of this article:

Elliptic found no trace of artificial intelligence in the circulation of funds stolen from Binance.

Failed transactions then returned identically point to scripts written and supervised by humans.

The North Korean group TraderTraitor mobilized around twenty automated services in less than three days.

Around 44% of the loot has already been frozen or seized, according to Elliptic.

A script is a program that executes the same list of instructions over and over again, without ever considering whether another route would be more discreet.

An artificial intelligence agent makes decisions and changes course when an obstacle appears. For example, if a wallet is blocked, it is supposed to look for another exchange or another bridge on its own.

On Binance funds, Elliptic observed nothing of this kind, and transactions that failed were returned identically, without investigating why.

The amounts corroborate this version of the facts. The hackers reused the same amounts, transfer after transfer, without trying to vary them.

Each new route was first tested with small transfers, followed later by larger amounts, once the path was validated.

On November 2, Elliptic co-founder Tom Robinson summed up the situation:

“Our assessment is that the laundering is automated. But nothing we've seen shows an AI agent making decisions. The schema corresponds to scripts written and supervised by people. »

Tom Robinson, co-founder and scientific director of Elliptic

What remains of the loot?

The scale of the operation is nevertheless impressive. In less than three days, the stolen funds circulated through around twenty automated services, from decentralized exchanges to lending protocols and bridges.

The pace was just as sustained. On October 30, six bridges appeared in feeds for the first time, in the span of 100 minutes. Elliptic could not establish whether humans or AI tools chose these services.

The FBI attributed the October 29 theft to the North Korean group TraderTraitor, and asked crypto services to block transactions involving the loot's wallets.

This profile surprises no one. North Korea has stolen $9.6 billion since 2019, and the Binance hack accounts for two-thirds of that.

The response has already borne fruit. Around $2.85 billion, or 44% of the stolen funds, were frozen or seized.

The rest is still circulating. The hackers still control $3.28 billion, scattered across more than 950 wallets.

The FBI had already ordered the THORChain protocol to block 242 million dollars laundered via Tron.