No proof of AI in North Korean hackers move of stolen Binance funds

No Proof of AI in North Korean Hackers’ Move of Stolen Binance Funds

Elliptic, a blockchain analytics firm, has released a detailed investigation into the recent wave of Binance fund withdrawals attributed to a North Korean hacking group. While some commentators speculated that the attackers might be employing advanced artificial‑intelligence (AI) tools to automate the complex series of transactions, Elliptic’s data points to a more conventional, script‑driven approach.

---

Scripted Automation, Not AI

Elliptic tracked thousands of wallet addresses that received portions of the stolen Binance assets. The pattern of transfers revealed several hallmarks of scripted activity:

• Repeated transaction structures – identical input and output formats appeared across multiple hops, suggesting a reusable code template.
• Failed swaps and rapid retries – the hackers attempted to convert the stolen tokens on decentralized exchanges, often encountering slippage or liquidity issues, then immediately re‑issued the same swap request.
• Uniform timing intervals – many transactions occurred at regular intervals (e.g., every 30‑45 seconds), a cadence typical of automated scripts rather than adaptive AI decision‑making.

These observations align with known tactics used by state‑backed cyber‑crime groups: they write custom scripts to interact with blockchain APIs, automate wallet generation, and execute bulk transfers. The scripts can be updated manually, but they do not exhibit the self‑learning or dynamic optimization that would be expected from a true AI system.

---

Why the AI Rumor Gained Traction

The speculation around AI stemmed from two factors:

1. The sheer scale of the operation – moving millions of dollars across hundreds of wallets in a short window can appear beyond human‑managed processes.
2. Media narratives – recent headlines have highlighted AI‑driven cyber threats, leading some analysts to extrapolate that any sophisticated attack must involve AI.

Elliptic’s report cautions against conflating automation with artificial intelligence. While scripts can execute high‑volume tasks efficiently, they lack the adaptive learning capabilities that define AI. In this case, the attackers relied on pre‑programmed logic, adjusting parameters manually when needed.

---

Implications for Crypto Security

Understanding the true nature of the threat is critical for both exchanges and users:

• Detection strategies should focus on identifying repetitive transaction patterns, abnormal swap failures, and rapid address churn rather than searching for AI‑specific signatures.
• Response measures can include rate‑limiting API calls, employing heuristic‑based monitoring, and tightening KYC/AML checks on wallets that receive large, fragmented deposits.
• Future threat modeling must recognize that state‑backed actors can achieve high‑impact results with relatively simple automation, underscoring the need for robust, rule‑based defenses.

---

A Practical Takeaway

For anyone managing crypto assets, the key lesson is to treat automation as a serious risk vector, independent of AI hype. Regularly audit transaction flows, employ analytics tools that flag repetitive patterns, and stay informed about the tactics used by nation‑state actors. By focusing on the concrete behaviors identified by Elliptic—scripted transfers, failed swaps, and uniform timing—organizations can better safeguard against similar large‑scale thefts.

---

The analysis reflects Elliptic’s findings as of November 2026 and does not incorporate any unverified claims about AI involvement.