Blockchain analytics firm Elliptic has uncovered a new laundering method used by North Korean-linked hackers after the $6.3 billion Binance hack. The group created at least six disposable meme coins on the NEAR blockchain between November 5 and 7, with laundering activity observed from November 5 to 11. They then used decentralized exchange liquidity pools to move stolen funds while making the flows appear to come from legitimate trades.
Elliptic traced roughly 117,000 NEAR tokens worth about $430,000 through the six tokens, identified as FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each token cost only around $90 to create, and there was virtually no organic trading. Wallets connected to the laundering operation accounted for nearly all purchases and sales, with most coins dumped within hours. No trading has been observed since November 8, the day after Elliptic published its analysis.
The laundering process worked by creating a worthless token and pairing it with NEAR in a liquidity pool. One wallet used stolen NEAR to buy the newly created token, while a separate wallet sold the token back to the pool and withdrew NEAR. This created a buffer that made the receiving wallet appear to be collecting proceeds from an obscure meme coin trade, even though the onchain trail remained visible.
The NEAR activity is only one part of a much larger operation. Elliptic has tracked Binance hack proceeds across more than 20,000 wallets, 16 blockchains, at least 36 services, and around 65,000 transactions, identifying about $3 billion in addresses it believes hold stolen funds. Similar token-based methods have been used on Tron and Solana, and Elliptic linked the pattern to the 2025 Bybit hack, in which more than $24 million was allegedly funneled through a fake token on Tron.
The FBI has attributed the Binance hack to North Korea’s TraderTraitor group, though North Korea has rejected the claims. Elliptic warns that funds arriving from newly launched, low-volume decentralized exchange liquidity pools are now a key red flag for crypto compliance teams.
