Blockchain Analysts Find No Proof of AI in North Korean Hackers' $6.4 Billion Binance Fund Move

The short version

Blockchain intelligence firm Elliptic stated on the weekend of November 2, 2026, that laundering operations used automated software rather than AI agents.

The FBI and blockchain investigators attributed the $6.4 billion Binance hack to North Korea's TraderTraitor and Lazarus groups, a role North Korea has denied.

Binance has frozen 44% of the stolen funds, leaving $3.28 billion still controlled by the hackers across more than 950 digital wallets.

Bitcoin fell to $78,000 U.S. in the days following the theft, while Binance recorded $5.28 billion in net outflows over a 46-hour period ending Tuesday.

Blockchain intelligence firm Elliptic reported that the laundering of $6.4 billion stolen from cryptocurrency exchange Binance relied on conventional software rather than artificial intelligence, directly challenging warnings raised by industry figures. The findings, published by Yahoo Finance and CoinDesk on November 2, 2026, come amid heightened market anxiety regarding digital asset security.

The massive theft sparked broader sector concerns about automated and advanced technology threats targeting centralized exchanges. Following the heist, Bitcoin fell to a price of $78,000 U.S., while Binance recorded $5.28 billion in net outflows over a 46-hour period ending Tuesday, according to CoinDesk reporting.

What did Elliptic find about the laundering methods?

Elliptic assessed that the hackers moved stolen funds through decentralized exchanges using approximately 20 automated software services, but found zero proof of advanced technology directing the operation. Elliptic stated, "Our assessment is that the laundering is automated, but nothing we have seen shows an AI agent making decisions," as reported by Yahoo Finance.

Who do investigators blame for the hack?

The Federal Bureau of Investigation attributed the $6.4 billion theft to North Korea's TraderTraitor hacking group, while blockchain investigators also linked the breach to North Korea's Lazarus Group, according to Yahoo Finance and CoinDesk reports. North Korea subsequently denied its role in the $6.4 billion Binance hack. Meanwhile, CZ (Zhao) issued warnings regarding AI-driven hacks following the heist, creating a divergence between executive warnings and the technical assessments provided by blockchain investigators.

What is the status of the stolen funds?

Binance has managed to freeze 44% of the stolen assets, leaving $3.28 billion still under the control of the hackers. According to Yahoo Finance, the hackers have spread these remaining funds across more than 950 digital wallets. Beyond ongoing tracking and investigation by firms like Elliptic and law enforcement agencies like the FBI, future developments in recovering the remaining funds have not yet been specified.

Frequently asked questions

How much of the stolen Binance money has been recovered?

Binance has managed to freeze 44% of the stolen funds, leaving $3.28 billion still controlled by the hackers.

Who did the FBI say carried out the Binance hack?

The FBI attributed the theft to North Korea's TraderTraitor hacking group, while blockchain investigators also linked the breach to the Lazarus Group.