the $6.4b binance loot is laundering on autopilot. it isn't ai.

daily ai × crypto news in 5 minutes. no hype, just what matters.

evening. since wednesday, the money stolen from binance has been moving nonstop, through the night, in thousands of tiny hops. the obvious question in crypto twitter: is an ai running the getaway? today elliptic, the firm tracking the funds, gave its answer: no evidence of it. the tell is not how fast the laundering is, it's how it fails. also tonight: coinbase lets ai agents trade perpetual futures, xdc gives every agent its own wallet, and a coin "mined" with ai work gets a place to sell.

what happened. on oct 29, hackers took $6.43b in crypto from binance, more than four times the $1.46b bybit theft of 2025 and the largest crypto theft on record. on oct 31 the fbi attributed it to tradertraitor, a north korean state-backed group it also blames for bybit. (elliptic)

the autopilot. elliptic's numbers read like a machine log. between oct 30 and nov 1, the attacker's main tron laundering wallet sent 1,113 separate transfers until it was nearly empty. median gap: 90 seconds. longest pause before it ran dry: 39 minutes, and it kept going through both nights in pyongyang. amounts are randomized down to six decimals to dodge simple monitoring rules; receiving wallets pass funds on within about two minutes; every new selling wallet on ethereum was funded with exactly 0.5 eth for fees; link was sold in 89 pieces and pepe in 94, about 36 seconds apart. (elliptic)

why that isn't ai. an ai agent decides and adapts: if a bridge rejects a deposit, it should figure out why and try another route. elliptic saw the opposite: bursts of failed bridge transactions from the same wallets, which "look more like a script retrying without fixing the cause than an agent learning from its mistakes." one thorchain swap amount appeared 19 times. "our assessment is that the laundering is automated, but nothing we have seen shows an ai agent making decisions. the pattern fits scripts written and supervised by people," co-founder tom robinson told coindesk. small test transfers before big moves and round-number shuffles between the attacker's own wallets still look like human hands. (elliptic, elliptic, coindesk)

where the money is. elliptic has verified $2.85b frozen or seized, 44% of the theft, almost all of it usdt and usdc: stablecoins have an issuer that can freeze them. the hackers still control about $3.28b across more than 950 wallets, mostly in bitcoin and ether, which nobody can freeze. a negligible amount has been cashed out so far, and about $16m has been sent to addresses tied to the bitget exploit, suggesting one laundering operation runs both. (elliptic, coindesk)

why it matters. two lessons. first, "ai did it" is becoming the default headline for anything fast, and it's usually wrong: speed is cheap with a cron job. the honest test is adaptation, and on-chain data can show it (routes that change right after a freeze) or rule it out (the same failed call, again and again). second, the part that actually slowed the thieves was boring: issuers freezing stablecoins. the coins that can't be frozen are the ones still walking. for a smaller version of the same pattern, see how the "steal my bitcoin" server fell in #013; for agents that really do adapt, around their own spending limits, see #015. more in crypto.

coinbase now lets ai agents trade perpetual futures. coinbase said on nov 2 that global derivatives trading powered by deribit is live for eligible coinbase for agents users: you connect your account to the ai platform you already use, and the agent can research, build a strategy and place trades within limits you set. the catch: it's for eligible non-us accounts that have completed derivatives onboarding, and trade approvals depend on the connected ai app. (panews, the defiant)

context: coinbase for agents launched on jun 11, and on oct 19 coinbase listed five index markets and perpetual contracts on more than 20 tokens for agents. so this is the step from "agents can buy" to "agents can use leverage." the limits are customer-set, the kind of guardrail a cornell tech and yale team showed agents walking around in a circle wallet test last week, when they could reach the approval channel. (tokenpost; background: #011, #015, #016)

every ai agent gets its own wallet on xdc, instead of the company card. xdc network and keyban announced a partnership on nov 2: keyban gives each agent a separate non-custodial account on xdc ai, xdc's agent payments marketplace. agents discover apis and pay per call in usdc, finance teams set each agent's budget, and every payment is recorded on chain and tied to the task that triggered it. keyban says it never takes custody of client funds. (keyban)

the pitch, in keyban founder charles kremer's words: "no cfo is going to hand an agent the corporate card and hope for the best." sensible design, but note what's missing: no usage or volume numbers. per-agent budgets are only as strong as whoever can change them, which is the same question as above.

a coin "mined" by doing ai work gets somewhere to sell. pearl's "proof of useful work" protocol is designed so gpus run real ai workloads while producing the proofs that secure its chain and issue pearl. as of nov 2, pearl trades on near.com and near intents, with swaps from supported assets across 35+ chains, confidential by default. (near)

near is candid about the use case: gpu operators pay for electricity, hardware and payroll in other currencies, so the first thing a "useful work" coin needs is a way into stablecoins. no price or volume figures were published. the idea of mining that does something useful is genuinely interesting; whether pearl's ai output has paying customers beyond its own token is the number to wait for.

elliptic binance hack blocklist: a free, continuously updated list of addresses elliptic has linked to the oct 29 binance theft, as a csv or through a public mcp server (https://public.mcp.elliptic.co/mcp) you can add to claude or another ai assistant and ask "is this address on the list?". free, no account or api key. for anyone receiving crypto from strangers (otc deals, small exchanges, dao treasuries) who wants to avoid touching stolen funds. note: it covers this hack only, not general risk. more picks in the gweiwire tools catalog.

whether the $3.28b in unfreezable bitcoin and ether starts hitting cash-out services, and whether elliptic's next update shows routes changing right after freezes (the first real sign of an adaptive agent). and on coinbase: whether agent derivatives come to us accounts.

that's the wire. fast isn't smart. watch how it fails. back tomorrow. — gweiwire

forward this to the friend who said "ai stole $6 billion." new here? subscribe at gweiwire.com. not financial advice. last sunday's case: how to earn crypto filming places for ai.