ABF-Bench agent runs live trace of Binance hot-wallet hack

A research agent built at Imperial College London and the University of Oxford is running a public live trace of the Binance hot-wallet hack from October 29, 2026, with every ledger flow it draws citing a specific transaction a verifier has already checked. The system comes out of ABF-Bench, posted to arxiv by Xiaohang Yu, Hejia Geng, and William Knottenbelt, and the live site carries a standing disclaimer: "This is agent output and has not been verified by human experts."

On the paper's own benchmark, the ABF harness reaches 75% edge recall against 47% for Codex and 10% for Claude Code on the same tasks. It recognises 89% of undisclosed custodial services where fixed-order tracers score 0%, at 98% citation fidelity.

The authors frame blockchain forensics as a verifiable agent task in which "every claimed movement must cite ledger records the agent retrieved," and a verifier checks each citation before a flow is drawn as solid. Benchmark tasks combine multi-hop transfers, DeFi exchanges, cross-chain round trips, mixer and custodial deposits, and address poisoning, built from real laundering activity.

The paper is explicit about where the harness fails: it "stops early on larger tasks." The Binance incident, reported by CNBC as roughly $6.3 billion stolen, is as large as these incidents get.