• Elliptic's assessment, as reported by CoinDesk, is that the laundering is automated but nothing shows an AI agent making decisions; the pattern fits scripts written and supervised by people.
• Elliptic has not ruled out AI involvement; its position is that the transactions it examined could have been carried out by human-written scripts.
• The FBI attributed the Oct. 29 theft to North Korea's TraderTraitor and asked crypto services to block transactions involving wallets linked to the stolen funds, per CoinDesk.
• Elliptic reports $2.85 billion (44%) frozen or seized, with the hackers still controlling about $3.28 billion across more than 950 wallets.
• Elliptic says about $16 million went to addresses holding proceeds of September's Bitget exploit, which it reads as the same laundering operation.

The laundering of the funds stolen from Binance looks automated, but there is no sign that an AI agent is choosing where the money goes. That is the finding of Elliptic as reported by CoinDesk on Nov. 2, 2026. The distinction matters for defenders: scripts supervised by people leave patterns that can be traced and blocked, and the FBI has already asked crypto services to block wallets linked to the theft.

What Elliptic found

Elliptic's assessment, quoted by CoinDesk from co-founder and chief scientist Tom Robinson, is that the laundering is automated but nothing it has seen shows an AI agent making decisions. CoinDesk reports the funds moved through about 20 automated software services in under three days, across decentralized exchanges, lending protocols and cross-chain bridges. Elliptic cites repeated transfers, failed transactions, reused amounts and small test transfers as script-like behavior, and has not ruled AI out.

Credit and recovery status

CoinDesk reports that the FBI confirmed the Oct. 29 theft was carried out by North Korea's TraderTraitor group and asked crypto services to block transactions involving linked wallets. Elliptic's figures, as cited by CoinDesk, are that $2.85 billion, or 44%, of the stolen funds has been frozen or seized, while about $3.28 billion sits across more than 950 wallets. CoinDesk's own summary describes the incident as a $6.4 billion hack; these are reported figures as of Nov. 2.

Link to the September Bitget exploit

Elliptic says about $16 million moved to addresses holding proceeds from September's Bitget exploit, which it takes to suggest the same laundering operation handled both attacks. CoinDesk's article gives no source or link for the Bitget incident itself, and Elliptic's report is not linked, so this connection should be read as one analytics firm's inference. If it holds, it would mean one operation is reusing laundering infrastructure across thefts.

What exchanges and compliance teams should take from it

The practical reading is that this laundering can be countered with ordinary controls: wallet-level blocking, rapid sharing of flagged addresses, and monitoring for scripted behavior such as test transfers and reused amounts. The FBI's request to block linked wallets and the 44% frozen or seized figure suggest that coordinated freezing is having an effect. The open question is the roughly $3.28 billion still under the hackers' control, and whether any forensic report later shows adaptive routing.