Elliptic: North Korean hackers laundered stolen Binance funds through self-made meme tokens, transferring approximately 117,000 NEAR through this method.

November 9 - According to blockchain analytics firm Elliptic, North Korea-linked money launderers are minting their own unwanted meme tokens and moving stolen Binance crypto assets through liquidity pools on decentralized exchanges, so that funds do not pass directly from wallets holding the proceeds of crime to receiving wallets. The tactic has appeared on Tron and NEAR, with a similar approach also seen on Solana. Elliptic said it first observed similar operations during the laundering of funds stolen from Bybit in 2025, when launderers minted worthless tokens on Tron and paired them with stablecoin liquidity pools, moving at least $24 million.

Elliptic said that on November 2 it identified on Tron worthless tokens created specifically to launder the Binance stolen funds; the next day, stolen SOL was swapped into wrapped and thinly traded tokens before being sold for USDC and bridged out. From November 5 to 7, the launderers minted at least six new meme tokens on NEAR - FUK, OLCCL, MEILI, MMLI, DABI and SINU - each paired with NEAR in separate liquidity pools, with a creation cost of about 25 NEAR each, or roughly $90. About 117,000 stolen NEAR, worth about $430,000 at current prices, was moved through these tokens, and the receiving wallets then sent out almost equivalent amounts, most of it into stablecoins or cross-chain bridges. The six tokens have had no trades since November 8, and the creators of four of them withdrew the remaining liquidity from the pools on the afternoon of that day. About 11.8 million NEAR of the stolen funds, worth about $43.7 million, has not yet moved. Elliptic said the tactic does not hide where the funds go, but it increases the time needed for on-chain tracing.