North Korean Hackers Laundered Binance Hack Funds via NEAR Meme Tokens: Elliptic

Blockchain analytics firm Elliptic has identified a money-laundering technique employed by North Korean-linked hackers in which they created short-lived meme tokens on the NEAR blockchain to obscure the movement of funds stolen in the October 2026 Binance hack. 

According to the findings on November 9, Elliptic notes that the method involves creating tokens that no external parties buy, pairing them with legitimate assets in liquidity pools, and using those pools to convert stolen cryptocurrency into assets controlled by a separate set of wallets. Elliptic previously documented a similar approach on Tron during the laundering of funds from the Bybit exploit and observed parallel activity on Solana after the Binance theft.

What was Binance’s $6.3 billion breach

The Binance incident began around 20:05 UTC on October 29. Attackers drained hot wallets across multiple networks, as reported earlier by The Crypto Times. Binance has estimated the loss at approximately $6.3 billion in Bitcoin, Ether, USDT, USDC, and smaller tokens. 

The company initially attributed the entry point to a compromised employee laptop and later reported additional points of compromise. The FBI has linked the theft to North Korea’s TraderTraitor group. 

Binance stated it would cover user losses from company funds, including its Secure Asset Fund for Users, and said it had replaced about 95 percent of the stolen assets. Withdrawals were suspended after the breach and restored in phases beginning November 1. 

Elliptic’s earlier analysis tracked the subsequent movement of the stolen assets. Roughly 11.8 million NEAR, valued at about $43.7 million at the time of the report, remained unmoved from the primary stolen-NEAR wallet when the meme-token activity was identified.

How the meme-token technique works

Elliptic notes that Anyone can create a new token on public blockchains. The launderers produced tokens that functioned solely as temporary containers. They followed four steps:

• Create a new token with a public launch tool.
• Open a liquidity pool pairing the token with NEAR or a stablecoin on a decentralized exchange.
• Route stolen NEAR into the pool from one set of wallets in exchange for the new token.
• Sell the token back into the same pool from a second set of wallets and withdraw the underlying asset.

Because the pool sits between the buying and selling wallets, the stolen funds do not move directly from one wallet to another. To an observer examining only recent transaction history, the collecting wallets can appear as ordinary traders exiting a position.

Tokens created on NEAR

Between November 5 and 7, the operators created at least six new tokens on NEAR, each paired with NEAR in its own liquidity pool:

• FUK, launched at 00:25 UTC on November 5
• OLCCL, MEILI, MMLI and DABI, created on November 6 between 07:19 and 14:27 UTC
• SINU, launched at 10:06 UTC on November 7

Each token cost approximately 25 NEAR (about $90) to create. The tokens carried standard meme-coin imagery, including animals and a banner referencing a political figure. Token names followed common meme-coin conventions. 

About 117,000 NEAR of stolen funds entered the six pools through intermediate wallets funded from the main stolen NEAR address. Nearly the same quantity exited the collecting wallets shortly afterward, much of it converted to stablecoins or transferred to cross-chain bridges. At prevailing prices the volume equated to roughly $430,000. 

Trading in each token was concentrated within hours of launch. By the afternoon of November 8 the creators of four tokens had withdrawn remaining liquidity, and none of the six had traded further.

Indicators of controlled activity

Elliptic reported three patterns consistent with controlled laundering rather than open-market trading:

• Nearly all purchases and sales of the six tokens were executed by wallets inside the identified network. Outside activity was limited to a small volume of FUK purchases on its first day.
• Five of the six token creators received funding from a wallet that had sold an earlier token only minutes earlier, forming a sequential chain.
• Each token was used promptly and then abandoned; the volume of NEAR entering each pool closely matched the volume leaving it.

The same pattern had appeared earlier on Tron, where a single worthless token moved at least $24 million from the Bybit theft, and on Solana, where thinly traded existing tokens were used to convert stolen SOL into USDC.

Implications for transaction screening

Elliptic noted that a wallet receiving funds from a liquidity pool cannot be assumed clean without examining what entered the pool. Observable warning signs include recently created tokens, pools traded by only a few wallets, wallets that exclusively buy or exclusively sell the token, and newly funded wallets that begin trading in round amounts shortly after receiving funds. 

The firm maintains a public blocklist of wallets linked to the Binance theft and updates it as additional addresses are identified. Continuous monitoring tools can re-screen previously cleared deposits when new labels are applied. 

The meme-token method does not erase the on-chain record; every step remains publicly visible. It adds intermediate hops that increase the time required to reconstruct the flow. Elliptic described the technique as one of several low-cost layers North Korean operators employ in parallel rather than a single concealment method.

Also Read: Mercado Bitcoin Begins Gradual Platform Access After Security Incident