Binance hack launderers mint throwaway memecoins to disguise stolen NEAR, Elliptic says

The people laundering the proceeds of the October 29 theft from Binance have started creating their own memecoins to disguise stolen funds, blockchain analytics firm Elliptic said on November 9. About 117,000 NEAR, worth around $430,000 at the time of Elliptic's report, passed through six such tokens on the NEAR network, all launched between November 5 and 7.

What Elliptic found

The launderers created at least six new tokens on NEAR, Elliptic said: one on November 5, four on November 6, and one on November 7. Every token got its own liquidity pool—a pot of the token and NEAR that traders swap against—on a decentralized exchange, saw heavy trading within hours of launch, and was then left idle. No trades in any of the six have taken place since November 8, the report says, and that afternoon the creators of four of them pulled the remaining liquidity from their pools. Launching a token cost roughly 25 NEAR, or about $90, according to Elliptic.

In Elliptic's description, the launderers create a token and a pool that pairs it with a real asset, buy the token with stolen funds from one group of wallets, and then sell it back into the pool from another group. With the pool between them, the buying and collecting wallets never deal with each other directly. At a glance, the receiving wallets look like ordinary traders cashing in on a winning memecoin.

The tokens were dressed up as ordinary memecoins—tokens built around a joke, an animal, or a celebrity. Most logos showed animals, such as a monkey, a duck, and a fox, and one name echoed the "-INU" dog coins. Another logo showed Elon Musk under an "Elon 2028 President" banner; Elliptic said "there is no suggestion that he has any connection to the tokens."

Why Elliptic says the tokens were made to launder

• Almost no outside buyers. Every sale of all six tokens, and every purchase of five of them, came from wallets in the laundering network. In the sixth, outside buying came to less than 1% of its volume.
• A chain of tokens. In five of the six cases, the wallet that funded a token's creator had itself been selling an earlier token, and the money arrived minutes before launch.
• Matching amounts. For every token, the NEAR paid into the pool from stolen funds equaled the NEAR taken back out.

Not only NEAR

Elliptic said it saw the same technique on Tron, where on November 2 it identified a worthless token made to launder Binance funds. The next day it found a close variant on Solana: stolen SOL, Solana's native token, was swapped into thinly traded existing tokens, then sold for Circle's USDC and moved to other blockchains. The firm first reported the method in the laundering of funds stolen from the crypto exchange Bybit in 2025, when at least $24 million moved through a home-made token on Tron.

The NEAR amounts are small next to what is left: about 11.8 million NEAR, worth $43.7 million, from the theft had not moved yet, Elliptic said. Elliptic's earlier tracing found the stolen funds spread across more than 20,000 wallets, and Tether and Circle froze more than $2.5 billion in stablecoins tied to the hack. Binance put the theft at about $6.3 billion; Elliptic counts $6.4 billion.

Who is behind it

The FBI has attributed the theft to TraderTraitor, a group it links to North Korea, and Elliptic calls the launderers "North Korea's launderers." North Korea has rejected the accusation.

Why it matters

The technique does not hide the money: every step is recorded on the blockchain, and Elliptic said the trail can still be followed. What it buys the launderers is time, Elliptic said: each extra hop has to be traced before the funds can be flagged. Elliptic advised compliance teams not to assume that money coming out of a liquidity pool is clean, above all when the pool trades a newly launched token. The red flags it lists include a token only days old, a pool with very few active wallets, and wallets that divide neatly into buyers and sellers.

What it could mean for traders

The risk sits with newly launched tokens: a pool whose trading volume comes almost entirely from a few linked wallets is not a sign of real demand, and funds that come out of such a pool may later be flagged by exchanges that screen deposits. The larger balance to watch is the 11.8 million NEAR from the theft that Elliptic says has not moved yet. Elliptic said it keeps a public list of wallets tied to the Binance hack and updates it as it finds new ones.