The North Korean launderers of the Binance hack have started minting their own memecoins on NEAR and trading them only with themselves, blockchain analytics firm Elliptic said on Monday 9 November. Six throwaway tokens, created between 5 and 7 November, carried about 117,000 NEAR (roughly $430,000) of stolen funds from one set of wallets to another, according to Elliptic’s analysis. None of the six has traded since 8 November.
The sum is tiny next to the $6.43 billion Elliptic counts as stolen from Binance on 29 October. The method is the news. Elliptic first saw this laundering trick after the Bybit theft of 2025, and its return in the Binance hack laundering shows the group Elliptic and the FBI call TraderTraitor reusing what worked. The bulk of the stolen NEAR, about 11.8 million tokens, had still not moved when Elliptic published.
The breach itself is in our report on the $6.4 billion Binance hack, and the attribution in our piece on the FBI naming TraderTraitor.
How the Binance hack laundering loop works on NEAR
The scheme rests on a decentralised exchange liquidity pool, the shared pot of two tokens that lets anyone swap one for the other at a price set by the pot’s balance. Elliptic describes the loop in four steps:
- The launderers create a new meme token and pair it with NEAR in a smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool on a decentralised exchange. Creating one cost about 25 NEAR, or roughly $90, per Elliptic.
- “Buying” wallets, funded with stolen NEAR, pay that NEAR into the pool and receive the new token.
- Separate “collecting” wallets sell the token back to the pool and take NEAR out.
- The token is dropped. Elliptic says each one followed the same life: created, traded heavily within hours with stolen NEAR, then abandoned.
The point is the gap in the middle. “At no point do the stolen funds move directly from a buying wallet to a collecting wallet, because the pool sits in between,” Elliptic wrote, as quoted by The Block. On a block explorer, the collecting wallets look like traders who bought a small coin early and sold it at a profit.
Elliptic adds a small detail that helps the disguise: the buying and collecting wallets carry random names generated by a popular wallet app, so the names do not link them. The funding does. Elliptic says the stolen NEAR that went into each token matched the NEAR that came out.
Six tokens in three days, all silent since 8 November
Elliptic named the six tickers and gave the creation time of each. The first, FUK, appeared at 00:25 UTC on 5 November; the last, SINU, at 10:06 UTC on 7 November. For the four tokens of 6 November, Elliptic gives one window rather than a time for each.
| Token | Created (UTC) | What Elliptic reports |
|---|---|---|
| FUK | 5 Nov, 00:25 | The only one with outside buyers: small purchases on day one, under 1% of its volume |
| OLCCL | 6 Nov, between 07:19 and 14:27 | Every sale made by the laundering network |
| MEILI | 6 Nov, between 07:19 and 14:27 | Every sale made by the laundering network |
| MMLI | 6 Nov, between 07:19 and 14:27 | One buying wallet and one selling wallet |
| DABI | 6 Nov, between 07:19 and 14:27 | One buying wallet and one selling wallet |
| SINU | 7 Nov, 10:06 | One buying wallet and one selling wallet |
The evidence that the tokens were built for laundering is in the trading pattern. Wallets of the laundering network made every sale of all six tokens and bought every unit of five of them. Five of the six token creators were funded by a wallet that had been selling an earlier token in the series between 2 and 13 minutes before the new launch. Each token was first sold within three hours of its creation, and at least three quarters of its trading happened inside one day.
“The launderers made six of these crypto tokens, and traded them only with themselves,” Tom Robinson, Elliptic’s co-founder and chief scientist, told CoinDesk.
The logos were the usual memecoin fare: a monkey with a pink bow, a duck in front of a US flag, a chimpanzee, a fox, a flaming gold badge, and a picture of Elon Musk under an “Elon 2028 President” banner. Elliptic says nothing suggests Musk has any link to the tokens. By the afternoon of 8 November the creators of four tokens had withdrawn what liquidity was left in their pools.
The money then left NEAR. Almost the same amount that went in, about 117,000 NEAR, left the collecting wallets shortly afterwards, largely into stablecoins or through a cross-chain bridge, according to Elliptic. The firm did not say which stablecoin or which bridge.
$430,000 out of $6.43 billion: a delay, not a disguise
Put in proportion, the memecoin route carried less than one hundredth of one percent of the theft. Elliptic does not present it as a way to hide the money. In its words, the technique “does not hide the funds so much as slow down the people tracing them.”
Every swap stays public on the NEAR blockchain. What the launderers buy is time: an analyst has to recognise that a token is fake, map the wallets around it and flag the collecting addresses before exchanges add them to their block lists. Elliptic sums up the logic in one line: “laundering is a race to move funds before they are flagged.” Tokens are cheap, so the launderers can make many and throw each away after use. Elliptic calls this one of several low-cost layers North Korean launderers stack on top of each other.
Elliptic also takes care to clear the tools. It says the token-launch tool, the exchange and the wallet app involved did nothing wrong; the launderers used them like any other customer.
The precedent is the February 2025 Bybit hack, which Elliptic also attributes to TraderTraitor. Then, the launderers created a worthless token on Tron, paired it with a stablecoin in a pool and had fresh wallets swap out. At least $24 million moved that way, Elliptic says. The Bybit operation was larger overall: about 499,000 ETH was laundered within ten days, mostly into bitcoin, and cashing out took months: the funds ended up as USDT on Tron and went through suspected Chinese over-the-counter trading services, according to Elliptic’s running tracker.
Tron got a home-made token too, Solana a different variant
NEAR is not the only chain where Elliptic saw the method. On 2 November it identified a worthless token on Tron created only for laundering, close to the Bybit model. About $220 million of the Binance loot has passed through Tron in total, and only about $0.5 million is left there, by Elliptic’s count.
On Solana the launderers did not mint anything. From 15:30 UTC on 3 November to 09:07 UTC on 4 November, about 725,000 SOL (around $67 million) left the original theft wallet. Part of it was swapped into wrapped Solana tokens that already existed but traded thinly, then sold for USDC and moved to other chains. About 2,300 SOL went into the Privacy Cash mixer, and Elliptic says only about 430 SOL remained in linked addresses as of 4 November.
Where the rest of the $6.43 billion sits on 9 November
Elliptic’s tracker, last updated at 13:15 UTC on 9 November, puts $2.85 billion of the theft as frozen or seized and about $3.0 billion still in addresses linked to the attacker, mostly in ether and bitcoin. The amount actually cashed out is probably negligible, the firm says. It sets the frozen share at about 44%, against about 3% after Bybit.
| Asset | Status per Elliptic (9 Nov) |
|---|---|
| Ether | About $3M of $1.27B moved; about 68,300 ETH in about 830 addresses; about 7,000 ETH (about $15M) sent to Tornado Cash since 8 November |
| Bitcoin | 18,270 BTC in 19 addresses, unmoved since 29 October; about 3,000 BTC (about $225M) converted from other stolen assets; about 130 BTC (about $10M) through coinjoins |
| XRP | About 139M XRP (about $154M) out of the attacker’s addresses, mostly into BTC; about 95M XRP (about $105M) left |
| NEAR | About $2M of $42M moved; about 11.8M NEAR (about $43.7M) unmoved |
| SOL | About $90M, all swapped, bridged or mixed; about 430 SOL left |
| Tron | About $220M passed through; about $0.5M left |
Two moves are new since the weekend. The first is Tornado Cash: about 7,000 ETH has gone into the Ethereum mixer since 8 November, in roughly 100 deposits to its 10 ETH pool and about 60 to its 100 ETH pool. That is still a small slice of the ether, and the nine largest ether addresses, which hold 89% of it, have not moved since 30 October.
The second is THORChain. Elliptic says attacker XRP swaps through the cross-chain protocol resumed from the afternoon of 8 November, although THORChain had halted XRP trading on 7 November. THORChain’s earlier, wider pause is covered in our piece on the THORChain swap halt. Elliptic did not explain how the swaps went through, and none of the three reports carries a comment from THORChain.
On NEAR itself, Elliptic counts about 412,000 NEAR (around $1.5 million) leaving the main stolen-NEAR account on 7 November, part of the roughly $2 million moved so far. The remaining 11.8 million NEAR is worth about $43.7 million by Elliptic’s price; The Block, at the prices of its own publication, put it at about $42.7 million.
What Elliptic left out of its analysis
Elliptic published no contract addresses or transaction hashes, and did not name the decentralised exchange or launchpad used on NEAR. Every figure on the six tokens therefore rests on its analysis; CoinDesk and The Block repeat the same numbers from it.
Neither Elliptic’s report nor the CoinDesk and The Block articles carries a reaction from Binance, the NEAR Foundation or any NEAR exchange. Elliptic mentions no freeze or delisting of the six tokens. Their pools were already empty or idle by the time the analysis came out, which limits what a freeze could have done.
CoinDesk put the theft at $6.3 billion in its headline; Elliptic and The Block use $6.4 billion, and Elliptic’s tracker gives $6.43 billion.
Why NEAR memecoin traders and exchanges are told to look twice
Elliptic’s advice is aimed at compliance teams, but it describes what any NEAR user who trades very young tokens may run into. Money that comes out of a liquidity pool is not clean by default, the firm says, especially when the token is new. It lists the signs that showed up in this case:
- the token was created in the last few days;
- the pool has very few traders;
- some wallets only buy and others only sell;
- fresh wallets are funded shortly before trading, often in round amounts.
Here, outside buyers took part in only one token, FUK, and for less than 1% of its volume. Anyone who did buy into these pools traded against the laundering network itself. Elliptic keeps a public blocklist of addresses linked to the Binance hack and tells firms to re-screen deposits they had already cleared each time the list grows.
The next figures to watch are the 11.8 million NEAR and the 18,270 BTC that have not moved, and the pace of the Tornado Cash deposits that began on 8 November.