Elliptic: North Korean Hackers Laundered Binance Loot With Throwaway Memecoins

Elliptic says North Korean hackers ran stolen Binance crypto through six throwaway memecoins on the NEAR network, turning a $430,000 trail into a screening headache for anyone downstream. The blockchain analytics firm's Monday analysis tracked 117,000 NEAR across those tokens, each of which cost about 25 NEAR — roughly $90 — to spin up.

Between November 5 and 7, the laundering wallets minted the six tokens and paired each one with NEAR in its own decentralized exchange liquidity pool. One set of wallets bought the tokens using stolen NEAR; another set sold them back for NEAR. No wallet in the first group ever sent funds directly to the second, Elliptic found.

That structure is the point. It makes receiving wallets look like ordinary profitable traders rather than loot recipients, which is exactly why Elliptic is telling firms not to hand a clean classification to funds that surface from liquidity pools. The telltale signs it lists: freshly created tokens, lopsided trading and single-purpose wallets.

The paper trail held anyway. Five of the token creators got funding from wallets that had sold earlier tokens just two to 13 minutes before. Outside wallets accounted for less than 1% of trading volume in one token, and according to Elliptic the other five had no outside buyers at all. All six tokens stopped trading by November 8, with four issuers pulling their remaining liquidity that afternoon. Elliptic counted about 11.8 million stolen NEAR still sitting unmoved at its snapshot.

It's a familiar playbook. Elliptic documented at least $24 million moving through a worthless Tron token after the 2025 Bybit breach, a homemade Tron token tied to Binance on November 2, and stolen SOL routed through existing thinly traded tokens the next day.

The FBI pinned the October 29 theft on North Korea's TraderTraitor operation, which attackers pulled off after compromising Binance employee devices. Pyongyang has denied responsibility. Binance said on November 3 the incident touched roughly $6.34 billion, with about $2.85 billion frozen or intercepted and 98% of affected assets replenished — funded by Binance, not by recovered loot.