Blockchain analytics firm Elliptic found that about $16 million stolen from Binance was sent to addresses holding funds from the Bitget attack, suggesting the two incidents may be part of a shared money-laundering operation.
Elliptic’s November 2 findings, reported by CoinDesk, examine how the stolen assets were moved after the October 29 Binance attack. One notable finding was that some of the funds reached addresses linked to the September Bitget attack.
The transfer of about $16 million suggests that proceeds from the two attacks may be processed in the same laundering operation. Elliptic views this connection not as a confirmed finding, but as a possibility indicated by on-chain movements.
Billions of dollars were spread across more than 950 wallets
According to figures in Elliptic’s report, $3.28 billion remained under the attackers’ control, spread across more than 950 wallets. About $2.85 billion had been frozen or seized, equal to 44 percent of the total cited in the report.
Most of the remaining assets are held in Bitcoin and Ethereum. While no centralized issuer can freeze these assets, Elliptic says only a very small portion of the funds appears to have been converted to cash.
The attackers used about 20 automated software services in less than three days. The money was moved through decentralized exchanges, lending platforms, and bridges that enable transfers between blockchains. Six different bridges were used for the first time within a 100-minute period on October 30 alone.
Did AI choose the money-laundering routes?
Tom Robinson, Elliptic’s co-founder and chief scientist, said that repeated transfer amounts, retries of failed transactions, and testing new routes with small amounts are consistent with automation software written and supervised by humans.
The company found no evidence in the fund movements it examined of autonomous AI agents making decisions on their own, but did not completely rule out the use of AI. It was also not possible to determine whether the six bridges were selected by people or AI systems.
Unlike the report describing the intrusion chain, which also involved Binance’s internal AI tool, this investigation focuses on money-laundering activity after the theft. The FBI attributed the October 29 attack to North Korea-linked group TraderTraitor and asked crypto service providers to block transactions linked to the stolen funds.
Not investment advice.