Elliptic: North Korean hackers created their own meme tokens to launder funds stolen from Binance, with roughly 117,000 NEAR transferred via this scheme.

According to blockchain analytics firm Elliptic, North Korea-linked money launderers are minting unsold meme tokens and transferring Binance-stolen crypto assets via decentralized exchange (DEX) liquidity pools, avoiding direct transfers from illicit wallets to recipient addresses. This modus operandi has been observed on the Tron and NEAR blockchains, with similar activity also spotted on Solana. Elliptic noted it first detected similar tactics during the 2025 Bybit hack fund laundering, where money launderers minted worthless tokens on Tron paired with stablecoin liquidity pools, moving at least $24 million. For the recent Binance hack, on November 2, Elliptic identified worthless tokens created specifically to launder the stolen funds on Tron; the following day, stolen SOL was swapped into illiquid wrapped tokens before being sold for USDC and cross-chain transferred. Between November 5 and 7, launderers minted at least six new meme tokens on NEAR: FUK, OLCCL, MEILI, MMLI, DABI, and SINU. Each token was paired with NEAR in separate liquidity pools, with each creation costing around 25 NEAR, roughly $90 at the time. Approximately 117,000 stolen NEAR, worth around $43 million at current prices, were transferred via these tokens; recipient wallets then moved nearly equal amounts, most of which went to stablecoins or cross-chain bridges. The six tokens have seen no trading activity since November 8, and four of their creators withdrew remaining liquidity from the pools that afternoon. Around 11.8 million NEAR, worth approximately $43.7 million of the stolen funds, remain un-moved. Elliptic added that while this method does not obscure the funds’ origin, it increases the time required for on-chain tracing.