No proof of AI in North Korean hackers move of stolen Binance funds

The crypto industry has a bad habit of assuming every sophisticated hack is the result of some futuristic AI super-intelligence. It makes us feel better about getting hit. If the machines are outsmarting us, it is not our fault, right? But the latest data on North Korea's Lazarus Group suggests the reality is much more mundane. They are not using LLMs to launder money; they are using the same basic automation tools that builders have been using for a decade.

The Anatomy of a Modern Wash

Following the massive drain of funds from Binance-related exploits, the industry watched closely as the stolen assets began to move. We saw thousands of wallets spring to life. We saw a dizzying array of transfers, hop-swapping, and attempted exits. To an outside observer, the sheer speed and volume looked like the work of an autonomous agent. The narrative started forming immediately: the hackers had built an AI money launderer.

New analysis from the team at Elliptic tells a different story. By breaking down the patterns of these transactions, they found something much more human and much more flawed. Instead of a fluid, self-correcting AI, they found thousands of failed swaps. They found repeated transactions that hit the same errors over and over again. They found rigid, scripted behavior that lacked the adaptability we associate with modern machine learning.

For anyone who has ever written a Python script to automate a repetitive task, this looks familiar. It is the sound of a bot hitting a wall and just keep banging its head against it because nobody told it to stop. This was not a thinking machine; it was a digital assembly line.

Why We Overestimate the Enemy

As a founder, I see this trend everywhere. We are in an AI bubble where every piece of software is suddenly an "agent." We have started projectng that same hype onto our adversaries. We assume that because North Korea is successful at stealing billions, they must be at the cutting edge of every technological vertical. In reality, they are efficient because they are disciplined and persistent, not because they have better code.

The move through those thousands of wallets was essentially a brute-force approach to obfuscation. If you move small amounts through enough addresses, you hope the sheer noise of the data will overwhelm the analysts at the exchanges and the chain-tracking firms. It is a volume game. Scripts are perfect for volume. They don't need to be "smart" to be effective; they just need to be fast and cheap to run.

The Scripting Reality Check

There are a few key reasons why scripts are still the weapon of choice for state-sponsored actors over AI agents:

• Predictability: When you are moving $100 million, you want to know exactly what the code is going to do. AI is non-deterministic. It might decide to try a new bridge that hasn't been tested, or it might get hallucinated into sending funds to a burn address.
• Security: Running a massive LLM or a complex agent framework requires infrastructure that can be tracked or compromised. A lightweight script can run on a burner laptop with almost no footprint.
• Cost-Effectiveness: Why build a Ferrari when a fleet of bicycles will get the job done? The Lazarus Group is a profit-driven enterprise. They use what works for the lowest possible overhead.

What This Means for Builders

If you are building in the security or compliance space, this is a wake-up call. If you are waiting to defend against "AI hackers," you are missing the threat that is already in your house. The current threat model is still dominated by automated scripts that exploit known human workflows and rigid smart contract logic.

We need to stop building for a sci-fi future and start fixing the present. The fact that these hackers can still move funds through thousands of wallets and occasionally succeed in swapping them for clean assets is a failure of our current monitoring systems. It doesn't take an AI to catch a script; it takes better data integration and faster response times at the protocol level.

The most dangerous threat isn't a sentient AI; it is a bored programmer with a script that doesn't care if it fails a thousand times before it succeeds once.

The Takeaway

Don't believe the hype that every hack is an AI-driven masterclass. The North Korean strategy remains the same as it has always been: high-volume, scripted automation paired with social engineering. They aren't out-thinking us; they are out-working us. For founders and developers, the lesson is simple: harden your systems against basic automation and don't let the AI noise distract you from the fundamental vulnerabilities in your stack.

The machines aren't coming for your seed phrase yet. It’s still just people with very long checklists and very fast scripts.

Read the original at CoinDesk →