Elliptic traced $430,000 in stolen Binance funds through six NEAR memecoins that cost roughly $90 each to create. | Credit: CCN.com
Share
Key Takeaways
Binance-linked launderers created six NEAR memecoins for roughly $90 each and moved about $430,000 through their liquidity pools.
The activity represented less than 0.01% of the approximately $6.4 billion theft.
Elliptic warned that funds received from decentralized exchange pools should not automatically be considered clean.
Launderers handling crypto stolen from Binance created six disposable memecoins, each costing roughly $90, using their trading pools to move approximately $430,000 between wallets, according to blockchain analytics firm Elliptic.
The activity represents less than 0.01% of the $6.4 billion theft.
However, Elliptic said the inexpensive technique could accommodate substantially larger amounts while complicating efforts to trace stolen assets.
The findings show how seemingly ordinary token trading can disguise connections between wallets without erasing the underlying blockchain trail.
Try Our Recommended Crypto Exchanges
Sponsored
Disclosure
We sometimes use affiliate links in our content, when clicking on those we might receive a commission at no extra cost to you. By using this website you agree to our terms and conditions and privacy policy.
Elliptic identified at least six tokens created on the NEAR blockchain between Nov. 5 and 7: FUK, OLCCL, MEILI, MMLI, DABI and SINU.
Each cost 25 NEAR, worth around $90, to create.
Together, their associated trading pools processed roughly 117,000 stolen NEAR, valued at approximately $430,000, according to the analysis.
The tokens carried familiar memecoin imagery, including cartoon animals and an Elon Musk-themed design. Elliptic said there was no suggestion that Musk had any connection to the activity.
The Binance hackers spent about $90 each to create six memecoins, then used them to launder stolen funds.
Buy the token from one wallet using stolen crypto, sell it from another, and nothing moves directly between the two. It reads as trading.
Their lifecycles followed a consistent pattern. Trading began shortly after creation, concentrated within a brief period and then stopped. None of the six had traded since Nov. 8, according to the report.
Elliptic found that wallets within the laundering network accounted for every sale across all six tokens. They also bought every unit of five tokens, while small outside purchases represented less than 1% of FUK’s volume.
Five token creators received funding from wallets that had sold an earlier token, connecting the launches through their financing.
Liquidity Pools Obscured Wallet Connections
The laundering depended on decentralized exchange liquidity pools acting as intermediaries between wallets holding stolen cryptocurrency and wallets collecting the proceeds.
Purchases funded with stolen NEAR added valuable assets to the pools. Other wallets sold the newly created tokens and received NEAR, making their transaction histories resemble proceeds from speculative trading.
No direct transfer connected the buying and collecting wallets. However, Elliptic traced their shared funding and trading patterns, finding that the stolen NEAR entering the pools closely matched the amounts subsequently leaving the pools, saving.
Elliptic: North Korean Hackers Create Meme Tokens on NEAR to Launder Binance Hack Funds
Blockchain analytics firm Elliptic reported that North Korean hackers are creating meme tokens and using DEX liquidity pools to launder funds stolen in the $6.4 billion Binance hack.… pic.twitter.com/Evm9trhwWn
Much of the collected cryptocurrency then moved into stablecoins or toward cross-chain bridges.
Elliptic said the token-launch service, exchange and wallet application had done nothing wrong. The perpetrators used publicly available infrastructure.
The approach also has a precedent. Elliptic previously identified at least $24 million moving through a similar homemade-token arrangement on Tron after the 2025 Bybit theft.
In the Binance investigation, analysts spotted comparable Tron activity on November 2. A related Solana pattern used existing, thinly traded tokens rather than newly created assets.
Traceable Transactions Still Create Delays
The memecoin activity forms one part of a much larger laundering operation following the October 29 Binance attack.
Elliptic estimated that the theft removed $6.43 billion across 11 blockchains and reported that the FBI attributed it to North Korea’s TraderTraitor group. Its earlier investigation also identified extensive automated transfers designed to redistribute funds rapidly.
The homemade tokens do not make transactions invisible. Instead, they introduce additional relationships that investigators must reconstruct before funds reach services capable of blocking or freezing them.
Evidence that the tokens were made to launder. | Credit: Elliptic
That delay matters when perpetrators can create replacement tokens cheaply and abandon them after a few hours.
Elliptic warned compliance teams against assuming that cryptocurrency arriving from a liquidity pool has a legitimate origin. Newly created tokens, concentrated trading and wallets that exclusively buy or sell can warrant closer examination.
The firm also recommended revisiting previously accepted deposits as investigators identify additional addresses.
For now, the amounts traced through these six memecoins remain small. Their significance lies in demonstrating another low-cost method for slowing investigators while stolen cryptocurrency continues moving.
Disclaimer:
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Giuseppe Ciccomascolo began his career as an investigative journalist in Italy, where he contributed to both local and national newspapers, focusing on various financial sectors.
Upon relocating to London, he worked as an analyst for Fitch's CapitalStructure and later as a Senior Reporter for Alliance News. In 2017, Giuseppe transitioned to covering cryptocurrency-related news, producing documentaries and articles on Bitcoin and other emerging digital currencies. He also played a pivotal role in establishing the academy for a cryptocurrency exchange website. Crypto remained his primary area of interest throughout his tenure as a writer for ThirdFloor.
