Elliptic traces $430,000 in Binance hack funds through six NEAR memecoins

Elliptic identifies new laundering method

Elliptic reported that North Korean hackers are using a new method to launder stolen cryptocurrency by creating worthless meme tokens. The technique involves routing stolen funds through decentralized exchange (DEX) liquidity pools to hinder tracing efforts. According to the report, the hackers created new cryptocurrency tokens using publicly available token-launch platforms. These tokens were then paired with legitimate assets, such as Near Protocol [NEAR] or stablecoins, within the liquidity pools.

Elliptic stated that wallets holding stolen funds were used to buy the newly created tokens. A separate set of wallets then sold the tokens back into the same pool to withdraw legitimate crypto assets. The liquidity pool structure prevented the direct transfer of stolen funds between the buying and selling wallets, creating a layer of obfuscation in the blockchain records.

Six memecoins used on NEAR network

Between Nov. 5 and Nov. 7, hackers created at least six memecoins on the NEAR network. The tokens are named FUK, OLCCL, MEILI, MMLI, DABI, and SINU. Elliptic noted that each of the six NEAR tokens carries a logo in classic meme coin style. The names follow meme coin habits, ranging from a crude joke (FUK) to an echo of the “-INU” dog coins (SINU).

Each token cost approximately 25 NEAR, or $90, to create. Around 117,000 NEAR, worth approximately $430,000, passed through these six tokens. The tokens experienced heavy trading within hours of their creation before being abandoned. In some cases, the remaining liquidity in the pools was withdrawn by the actors.

Technique observed in Bybit hack

This laundering technique was previously observed during the Bybit hack in 2025. During that incident, at least $24 million was moved through a worthless token on the Tron [TRON] network. Elliptic identified the use of this approach across the TRON [TRX], NEAR, and Solana [SOL] networks.

The FBI attributed the Binance theft to TraderTraitor, a North Korean state-sponsored hacking group. Elliptic’s analysis connects the specific transaction patterns on the NEAR network to the group’s known operational methods. The report highlights the increasing sophistication of the laundering mechanisms employed by state-sponsored cybercriminals.

North Korean cyber-espionage group Kimsuky is also increasingly using AI tools to strengthen its cyberattacks, according to recent assessments. While the current report focuses on the financial laundering aspect of the Binance hack, it underscores the broader threat landscape involving North Korean actors in the digital asset space.

Implications for tracing stolen funds

The use of DEX liquidity pools to wash stolen funds presents a significant challenge for blockchain analysts. By breaking the direct link between the source of the stolen funds and the final destination of the clean assets, the technique complicates the work of law enforcement and intelligence agencies. The low cost of creating these tokens, at approximately $90 each, makes the method accessible and scalable for future operations.

Elliptic’s findings provide critical data for tracking the specific wallets involved in the Nov. 5–7 activity on NEAR. The identified transaction patterns can serve as a reference for detecting similar laundering activities on other blockchains. As regulatory scrutiny on decentralized exchanges increases, the ability to trace funds through these complex pool structures becomes a focal point for compliance efforts.