Blockchain analytics firm Elliptic says North Korean hackers used newly created memecoins on the NEAR blockchain to help move cryptocurrency stolen in the $6.4 billion Binance hack. According to the firm, roughly $430,000 was routed through six tokens launched between Nov. 5 and Nov. 7 as part of a laundering process designed to make the flow of funds harder to follow.

Elliptic said the activity relied on thinly traded tokens and decentralized exchange liquidity pools rather than direct transfers between wallets. The firm added that the transactions were still visible onchain, even though the structure introduced extra steps and delays into the movement of the stolen assets.

Six tokens launched over three days

Elliptic’s report says the hackers created at least six tokens on NEAR during the three-day period. The tokens reportedly drew almost no outside trading activity and were abandoned soon after launch, indicating that their primary purpose was not market speculation but facilitating transfers between controlled wallets.

The analytics firm traced around $430,000 through those tokens. In its account, the operators used a set of wallets holding stolen NEAR to buy the newly issued memecoins, then used another set of wallets to sell the same tokens back into liquidity pools in exchange for NEAR.

How the swaps obscured the trail

The method described by Elliptic allowed the attackers to move value without sending funds directly from one wallet to another. By passing the assets through decentralized exchange pools and low-liquidity tokens, the transactions added complexity to the trail while avoiding a straightforward transfer pattern.

Elliptic stressed that this did not make the activity invisible. Because the swaps took place onchain, investigators were still able to reconstruct the sequence of transactions and connect the wallets involved.

Linked funding patterns across token launches

Elliptic also identified a pattern tying the token launches together. It said five of the six wallets that created the tokens were funded by proceeds from earlier token sales only two to 13 minutes before the next token was launched.

That sequence, according to the firm, linked the six memecoins into a chain of related transactions. Elliptic co-founder Tom Robinson said North Korean laundering operations typically do not depend on a single mechanism, but instead combine multiple inexpensive tactics that each add a small amount of delay.

Comparison with an earlier case

Elliptic said the same general laundering technique had appeared before. The firm pointed to activity after the 2025 Bybit hack, when North Korean-linked actors allegedly moved at least $24 million through a newly created token on the TRON blockchain.

The comparison suggests that ad hoc token creation and decentralized exchange liquidity can be reused across blockchains as part of a broader laundering playbook, though Elliptic’s findings in this case are specific to the funds it traced on NEAR.

What remains unmoved

At the time of Elliptic’s analysis, about 11.8 million NEAR stolen in the Binance hack had not moved. The firm valued those holdings at approximately $43.7 million at that time.

The next confirmed point is whether those remaining funds begin to move and, if they do, whether they follow the same route through newly launched tokens and decentralized exchange pools. For now, Elliptic’s report documents one identifiable portion of the laundering activity rather than the full disposition of the stolen assets.

Source: cointelegraph.com