Skip to main content

AI role in Binance theft remains unproven as laundering analysis emerges

31 OCTOBER 2026·2 MIN READ·11 SOURCES

Elliptic said it found no evidence that AI directed the laundering of funds from the alleged Binance theft, describing activity that appeared to follow instructions set by people. Yahoo Finance’s video description says Scott Melker discusses how AI may have helped attackers evade detection during the breach.

AI role in Binance theft remains unproven as laundering analysis emerges

Key takeaways · 4

  • 01

    Binance put its losses at approximately $6.3 billion; Elliptic’s estimate was $6.43 billion.

  • 02

    Elliptic found no evidence AI directed the laundering, which it said looked like software following people’s instructions.

  • 03

    Elliptic described hourly transfers from a main Tron wallet for 31 straight hours and roughly 200 recipient wallets that typically passed funds onward within about two minutes.

  • 04

    Binance said it would cover the stolen funds and had set aside more than $6.34 billion in company funds, including $5 billion in the exact stolen tokens.

AI claims and what the evidence shows

The available evidence separates a possible role for AI in the breach from the laundering that followed.[1][3][4] Yahoo Finance’s description frames AI as a possible tool for evading detection, and a BBC quote says it was plausible AI was used to infiltrate Binance’s systems.[1][3] Elliptic, however, said it found no evidence AI directed the laundering and characterized the activity as automated software following instructions set by people.[4] That finding addresses the laundering, not whether AI played a role in gaining access to Binance’s systems.[3][4]

Transaction patterns and laundering routes

Elliptic said the main Tron distribution wallet sent funds every hour for 31 straight hours, with its longest pause lasting 46 minutes.[6] Roughly 200 recipient wallets typically passed funds onward within about two minutes, and transfers were almost never less than about 30 seconds apart.[6] Elliptic also reported that about $31 million had gone into THORChain, at roughly 100 swaps every two hours since midnight.[6] These details describe observed transaction activity; they do not establish that AI directed it.[4]

Loss estimates and frozen funds

Binance estimated losses at approximately $6.3 billion in token assets, while Elliptic put the amount stolen at $6.43 billion.[2][5] The evidence does not explain the difference between those estimates.[2][5] Binance said approximately $3 billion had been frozen on-chain to date; Elliptic separately estimated $2.85 billion, or 44% of the stolen funds, had been frozen or seized.[2][4] The figures come from different sources and describe their respective estimates, so they should not be treated as one reconciled total.[2][4]

Attribution and Binance’s response

The BBC reported that TRM Labs and Chainalysis identified North Korea’s Lazarus Group, also known as TraderTraitor, as likely responsible.[3] CoinDesk reported that the FBI attributed the October 29 theft to North Korea’s TraderTraitor hacking group.[4] Binance said it would cover the stolen funds rather than pass their financial impact to users, and that deposits and other unaffected services remained operational.[2] It was targeting a phased restart of withdrawals within approximately 34 hours, subject to security checks.[2]

For security and finance teams, the key distinction is between a possible AI-assisted intrusion and laundering that Elliptic says showed no evidence of AI direction. Treat the transaction observations and competing frozen-fund estimates as attributed assessments, not a definitive account of how the breach happened or how much has been recovered.

Why it matters
Daily session

Bring this to your team — one session a day, built for your industry.

kju.ai is built for teams: daily sessions, team analytics, and rollout support for your organization.

For teams

How this developed

  1. 2 November 2026

    New reporting adds Elliptic’s assessment that it found no evidence AI directed the laundering, its transaction-flow observations, and its estimate that $2.85 billion had been frozen or seized; CoinDesk also reports the FBI attributed the theft to North Korea’s TraderTraitor group.

  2. 2 November 2026

    Binance says recovery coverage rose to 90% by October 31, and it has identified additional breach points beyond the initially suspected laptop compromise.

  3. 31 October 2026

    The BBC reports that Binance said 80% of the stolen assets had been secured, with the rest unaccounted for, and that two analytics firms cited intelligence pointing to a North Korean state-backed group as the likely culprit; it also says AI involvement in the infiltration is plausible but unconfirmed.

  4. 31 October 2026

    Eric Schiffer warns Binance breach could foreshadow AI-fueled attacks

Sources

AI fluency, one session a day, built for your work.

For teams