Elliptic: Binance laundering is scripts, not AI agents — $3.24B still at large

Elliptic chief scientist Dr. Tom Robinson published a detailed on-chain breakdown of the laundering of the $6.43 billion stolen from Binance on October 29, 2026. The headline finding: the laundering is heavily automated, but there is no evidence of AI agents making decisions — the behaviour fits conventional scripts with fixed timing, set amounts and blind retries. Primary: Elliptic blog, Nov 2. Secondary: CoinDesk coverage.

What Elliptic found

"The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions." — Dr. Tom Robinson, Elliptic.

The on-chain pattern is identical-amount transfers, pre-scripted retries after failures, and small test transactions before larger ones. An AI agent trying to adaptively re-route would show branching based on prior outcomes. The Binance transfers do not: when a route fails, the script re-attempts the same route, then falls through to the next pre-coded path.

Numbers (as of November 2, 2026)

• Stolen on October 29: $6.43 billion, across 11 blockchains
• Frozen or seized: $2.85 billion (~44%)
• Still in linked addresses: ~$3.24 billion, mostly ETH and BTC — likely still held by TraderTraitor
• Wallet count: ~12,000 wallets
• Transaction count: >40,000 transactions in under four days
• Tron sub-cluster: ~7,700 addresses, ~32,000 transactions
• Bridged out of Tron so far: at least $147 million
• Overlap with September Bitget exploit addresses: ~$16 million

The Tron distribution and the 150-minute bridge window

Elliptic's timeline, in condensed form:

1. 02:19 UTC, Oct 30 — Tron distribution starts. Funds split across ~7,700 Tron addresses.
2. Within ~150 minutes of that start, the attacker made first transfers through six cross-chain bridges. Most of these were test-sized before scaled transfers followed.
3. From Tron, at least $147M has been bridged out so far.
4. Downstream chains and services named by Elliptic include Ethereum, Solana, NEAR, XRP and Bitcoin, with on-ramps and off-ramps through Uniswap, Aave, SunSwap, JustLend and USDD. WabiSabi coinjoins are used for Bitcoin mixing.

The multi-bridge opening is itself the strongest script tell: six separate bridge adapters warmed up in parallel, each with their own gas-funding wallets, nonces and relayer calls. Spinning six adapters on a human timeline would show staggered first-use; Elliptic sees them within the same ~2.5-hour window.

Attribution

The FBI, USSS and IRS-CI formally attributed the theft to TraderTraitor on October 31 and published blocklist addresses (see our prior coverage: FBI attribution and blocklist). Chainalysis reached the same conclusion from on-chain commingling with the September Bitget theft. Elliptic's $16M Bitget-overlap figure confirms that commingling independently.

Freezing picture — who did what

The $2.85B frozen figure is a composite:

• Tether and Circle blacklisted USDT/USDC addresses linked to the loot, immobilising the stablecoin leg.
• Centralised venues flagged deposit addresses on receipt.
• Some on-chain protocols with pausable guardians (not named in the Elliptic post) froze pool positions.

The remaining $3.24B is weighted to ETH and BTC — assets with no central issuer freeze capability. That skew is intentional: scripts prioritised converting into assets that can't be clawed back by a single counterparty. It is the mirror image of the pattern Elliptic documented after the Bybit heist in 2025.

Pattern

This is the fifth TraderTraitor laundering operation Elliptic has mapped in detail (Ronin 2022, DMM Bitcoin 2024, Bybit 2025, Bitget September 2026, Binance October 2026). The playbook each time: identical-amount transfers in parallel, test transactions before scaled flows, aggressive early use of cross-chain bridges to escape single-chain monitoring, and a residual balance held in non-freezable assets. The Binance incident is the largest by dollar value but reads like an iterative tune of the same tool-chain, not a new one — and specifically not one driven by LLM-based agent frameworks that have become a 2026 ecosystem talking point.

What to watch

1. Whether Elliptic or Chainalysis publishes attribution-grade address lists downstream of the six Oct 30 bridges — Relay, THORChain, Chainflip, Symbiosis and two unnamed in Elliptic's post.
2. Second-leg sanctions from OFAC against named mixers or OTC desks downstream of TraderTraitor's residual $3.24B.
3. Whether any of the Tron $147M bridge-out flows surface at centralised exchanges in jurisdictions outside the FBI blocklist's reach.
4. The next TraderTraitor target — the September Bitget / October Binance interval was five weeks, matching the group's prior cadence.