- Elliptic traced roughly 117,000 NEAR (about $430,000) through six newly created memecoins on the NEAR blockchain between November 5 and 7.
- The technique routes stolen funds through DEX liquidity pools so that no direct wallet-to-wallet transfer occurs, a method previously used after the 2025 Bybit hack to move at least $24 million.
- One token featured an image of Elon Musk under an “Elon 2028 President” banner; Elliptic stated there is no connection to Musk.
- The October 29 Binance theft remains the largest crypto hack on record at approximately $6.4 billion, attributed by the FBI to North Korea’s TraderTraitor group.
Blockchain analytics firm Elliptic has identified a fresh layer of obfuscation in the laundering of funds from the record $6.4 billion Binance hack, with North Korean-linked actors minting six throwaway memecoins to move stolen NEAR tokens.
According to Elliptic’s analysis published Monday, approximately 117,000 NEAR, valued at roughly $430,000 at the time, passed through the six tokens created between November 5 and November 7. The tokens, named FUK, OLCCL, MEILI, MMLI, DABI and SINU, each cost about 25 NEAR (around $90) to launch and were paired with NEAR in their own decentralized exchange liquidity pools. The Block reported that the tokens featured animal mascots, including a monkey with a pink bow and a duck against a U.S. flag, along with one carrying an image of Elon Musk.
The method works by having one set of wallets buy the memecoins using stolen NEAR, while a second set of wallets sells the same tokens back into the pool and collects NEAR. As Elliptic noted, “At no point do the stolen funds move directly from a buying wallet to a collecting wallet, because the pool sits in between.” This creates the appearance of ordinary trading activity. Almost all volume came from the launderers’ own wallets, with outside buyers accounting for less than 1% of trading in at least one token, and activity ceased by November 8, with liquidity withdrawn from four pools that day.
This approach mirrors a tactic Elliptic first documented in the laundering of proceeds from the February 2025 Bybit hack, which moved at least $24 million. Similar activity was observed on Tron on November 2 and on Solana the following day. CoinDesk quoted Elliptic co-founder Tom Robinson stating that the launderers “made six of these crypto tokens, and traded them only with themselves. That makes the stolen funds look like trading proceeds.”
The underlying Binance incident occurred on October 29, when attackers drained assets across multiple blockchains in what analytics firms including Elliptic, Chainalysis and TRM Labs have described as the largest crypto theft on record. The FBI has attributed the theft to the TraderTraitor group. While the memecoin activity represents only a small slice of the total haul, it illustrates how state-linked actors continue to layer inexpensive on-chain techniques to complicate tracing even as exchanges, stablecoin issuers and analytics firms coordinate freezes that have already immobilized roughly $2.85 billion of the stolen funds.
For traders and compliance teams, the development underscores the ongoing risks around hot-wallet infrastructure and the evolving toolkit used by sophisticated actors. Elliptic has maintained that the trail remains followable on-chain, and it continues to update public blocklists of associated addresses. Binance has stated it is covering user losses from company reserves and has been restoring withdrawals in phases.
