Nearly a week after a massive security breach drained an estimated $6.43 billion from Binance, recovery efforts and forensic investigations are revealing a complex combination of automated laundering, artificial intelligence-assisted targeting and phased withdrawal restoration. Binance says it has begun restoring customer withdrawals across 15 blockchain networks, while blockchain analytics firm Elliptic reports that North Korean-linked attackers have moved stolen funds through more than 40,000 transactions and roughly 12,000 wallets in less than four days.
Withdrawal restoration and asset backing. Binance confirmed the phased reopening covers Bitcoin, Ethereum, XRP Ledger, Solana, BNB Smart Chain, Dogecoin, Avalanche, Sui, Polygon, Arbitrum and Zcash, alongside stablecoins USDT and USDC. The exchange stated it has recovered or restored approximately 95% of affected assets, up from 90%, and committed more than $6.34 billion in company funds to cover losses. Binance also said it has full asset backing for major cryptocurrencies including BTC, ETH, XRP, SOL and BNB.
No evidence of AI-driven laundering. Elliptic's analysis challenges speculation that autonomous AI agents are coordinating the laundering operation. Instead, the transaction patterns indicate conventional software automation: fixed timing, repeated transfer amounts, retried failures and new laundering methods introduced in distinct stages. Investigators recorded about 32,000 transactions on Tron alone, peaking at 1,300 transfers in one hour, with one distribution wallet completing 1,113 transfers over 51 hours.
Fund freezing and cross-chain movement. Elliptic estimates roughly $2.85 billion, or 44% of stolen assets, has been frozen or seized, while $3.24 billion remains in addresses linked to the theft. Tether and Circle froze stolen USDT and USDC before significant conversion, although about $786 million in stablecoins was converted before restrictions took effect. Arbitrum's Security Council separately froze $30.5 million in connected assets. Hackers have used at least seven cross-chain bridges, moved $147 million out of Tron via bridges, and used lending protocols such as JustLend to disrupt tracing. Elliptic also detected the first Bitcoin mixing activity on November 1, with roughly 28 BTC worth $2.2 million passing through 18 coinjoin transactions by early November 2.
FBI attribution and ongoing threat. The FBI has attributed the October 29 attack to North Korea's TraderTraitor operation, which stole assets across 11 blockchains. Elliptic now associates more than 9,500 addresses with the Binance theft and expects attackers to continue converting Ether into Bitcoin before attempting cash-outs through centralized exchanges and over-the-counter brokers over several months.
AI-powered victim profiling. Separately, Cisco Talos researchers detailed how Windows malware known as VOLTA-AUTODOXER is using external AI models to identify wealthy crypto wallet owners. The malware first sends collected victim data to Anthropic's Claude Opus 4.6, then falls back to Moonshot AI's Kimi K2 or Google's Gemini 2.5 Flash through OpenRouter if requests are refused. Ryan Fetterman of Cisco Talos said the malware extracts wallet recovery phrases, encrypted wallet vaults, browser passwords, payment card details, authentication tokens and email records, then ranks victims by financial value. It also searches for purchase confirmations involving Amazon, PayPal, Walmart, DoorDash and Uber Eats to build detailed victim profiles.
