An investigation by blockchain analysis firm Elliptic identified approximately 12,000 digital wallets and more than 40,000 transactions related to the movement of cryptocurrencies stolen from Binance. The funds passed through 11 blockchains in less than four days after the October 29 attack, which resulted in the disappearance of about US$ 6.43 billion in digital assets.
The report, published this Monday (2), reveals that US$ 2.85 billion was frozen or seized, equivalent to approximately 44% of the stolen value. Another US$ 3.24 billion remained in addresses associated with the attack, mainly in bitcoin (BTC) and ether (ETH). According to Elliptic, only an insignificant portion had likely been converted into cash.
Most of the movement occurred on the Tron network, where those responsible distributed the funds among approximately 7,700 addresses. The operations involved transfers between blockchains, cryptocurrency swaps on decentralized platforms and mechanisms that make it difficult to identify the origin of the assets.
On November 2, researchers also identified a new movement: 233 million XRP were transferred to six different addresses after remaining dormant since the theft.
The FBI attributed the attack to the TraderTraitor group, associated with North Korea, in a statement released on October 31. Elliptic notes, however, that blockchain analysis makes it possible to track the assets but not to directly identify who controls each wallet.
Tracing found no evidence of decisions made by AI agents
The speed of the transfers raised suspicions about the possible use of artificial intelligence agents to coordinate the movement of the funds.
However, researchers found patterns consistent with conventional automated programs, including transfers at regular intervals, predefined amounts and repetition of operations that failed.
"The laundering is clearly automated, but nothing we have seen demonstrates an AI agent making decisions," wrote Tom Robinson, the researcher responsible for the Elliptic report.
On the Tron network, approximately 32,000 transactions were recorded, with peaks of 1,300 operations per hour. For the investigators, the intensity of the activity demonstrates the use of automation but does not prove decision-making autonomy based on artificial intelligence.
The company also identified the use of bitcoin mixing mechanisms to hinder tracing. By the morning of November 2, approximately 28 BTC, valued at US$ 2.2 million, had passed through these operations.
Elliptic continues to monitor the addresses associated with the attack. The frozen amounts remain distinct from the funds effectively recovered, while most of the assets still traced had not been converted into cash.
