TLDR
- Elliptic says North Korean hackers moved about $430,000 in stolen NEAR through six new memecoins.
- The tokens were made on NEAR between Nov. 5 and Nov. 7 and were quickly abandoned.
- Liquidity pools kept stolen funds from moving directly between wallets.
- The same method was used after the 2025 Bybit hack.
- About 11.8 million stolen NEAR had not moved at the time of the analysis.
Blockchain analytics firm Elliptic said North Korean hackers used newly made memecoins to move crypto stolen in the Binance hack. The firm published its report on Monday.
Elliptic: North Korean Hackers Create Meme Tokens on NEAR to Launder Binance Hack Funds
Blockchain analytics firm Elliptic reported that North Korean hackers are creating meme tokens and using DEX liquidity pools to launder funds stolen in the $6.4 billion Binance hack.… pic.twitter.com/Evm9trhwWn
— Wu Blockchain (@WuBlockchain) November 9, 2026
Elliptic traced about 117,000 NEAR through six new tokens. That amount was worth roughly $430,000 at the time.
The tokens were created on the NEAR blockchain between Nov. 5 and Nov. 7. Almost no outside traders bought or sold them.
How the memecoin swaps worked
The hackers used one group of wallets to buy the memecoins with stolen NEAR. A second group of wallets then sold the tokens back into a liquidity pool and collected NEAR.
Liquidity pools on decentralized exchanges sat between the two groups. Because of that, stolen funds never moved straight from a buying wallet to a collecting wallet.
Elliptic said the collecting wallets could look like ordinary traders who sold a token at a profit. The transactions stayed public and traceable on the blockchain.
The firm said the extra swaps only act as hurdles. They slow investigators down and give launderers a little more time before wallets are flagged.
The tokens used animal mascots, and one had an expletive as its ticker. Another used an “Elon 2028 President” banner, though Elliptic said nothing suggests Elon Musk was linked to it.
All six tokens were abandoned soon after launch. Much of the NEAR collected went into stablecoins or cross-chain bridges.
Elliptic found that five of the six token creators were funded with proceeds from earlier token sales. The money arrived two to 13 minutes before the next launch, which linked the tokens in a chain.
Link to the Bybit hack and the Binance attack
Elliptic said the same method was used after the $1.5 billion Bybit hack in 2025. North Korea-linked actors moved at least $24 million through a newly created token on the TRON blockchain.
In the Binance case, the firm also saw a similar approach on Solana. Those transfers used existing tokens with low liquidity.
“North Korea’s launderers rarely rely on a single technique,” Elliptic co-founder Tom Robinson wrote in the report. “Instead, they layer many cheap techniques, each adding a little more delay.”
Binance’s incident report said the attack had been in the works for months. It involved malicious developer software, a fake job interview and compromised AI tooling, and the exchange said the FBI linked the attack to North Korea.
On Friday, Elliptic tracked about $124 million in stolen assets that had been converted into bitcoin.
At the time of Elliptic’s analysis, about 11.8 million NEAR from the hack had not moved. Reports valued those funds at more than $42 million.
