North Korean hackers are using self-issued tokens and decentralized exchange liquidity pools to move funds linked to the Binance hack, according to blockchain analytics firm Elliptic. The company said the approach lets attackers shift assets between wallets without making a simple direct transfer, adding extra layers that can slow investigators even if the transactions remain visible on-chain.
Elliptic said it observed the method across Tron and NEAR, with a similar pattern on Solana. The clearest example involved a cluster of newly launched NEAR tokens that handled a relatively small share of the stolen assets, while a far larger amount of hacked NEAR was still sitting unmoved.
How the laundering method works
According to Elliptic, the wallets behind the scheme create a new token, pair it with a legitimate asset such as NEAR or a stablecoin, and place both into a decentralized exchange liquidity pool. One set of wallets then uses stolen funds to buy the new token, while a separate set later sells that token back into the pool to receive the original crypto.
That structure inserts the liquidity pool between the sending and receiving wallets. Elliptic said the tactic does not erase the transaction trail, but it makes tracing slower because investigators must follow a chain of token launches, swaps and additional wallet activity rather than a straightforward wallet-to-wallet transfer.
Activity tracked on Tron, Solana and NEAR
Elliptic said it first documented this kind of laundering while investigating losses tied to Bybit in 2025, when launderers created a worthless Tron token and moved at least $24 million through a liquidity pool. The same playbook resurfaced after the Binance theft.
On November 2, the firm identified a newly created Tron token that it said appeared to have been launched specifically for laundering. The following day, stolen Solana was swapped into wrapped and lightly traded tokens before being converted into USDC and sent on to other blockchains.
Six NEAR tokens handled about $430,000
The most detailed evidence came from NEAR activity between November 5 and 7. Elliptic said the attackers created six tokens — FUK, OLCCL, MEILI, MMLI, DABI and SINU — and paired each of them with NEAR in separate liquidity pools. The cost to create each token was about 25 NEAR, or roughly $90.
Across those six tokens, about 117,000 NEAR, valued at around $430,000, was moved. Elliptic said the buying wallets were funded with stolen NEAR, and nearly the same amount later emerged through different wallets, with much of it either converted to stablecoins or bridged to other chains.
The trading pattern did not resemble normal market activity, according to the firm. The laundering-linked wallets accounted for almost all of the buying and selling, and three of the tokens — DABI, MMLI and SINU — each had just one buying wallet and one selling wallet. After heavy activity shortly after launch, the tokens were abandoned, with no further trading reported after November 8.
What investigators are watching next
Elliptic said proceeds from earlier token launches were used to fund later ones, tying the six-token NEAR operation together. Because launching a token costs so little, the firm warned that the attackers can keep repeating the process with fresh assets and new liquidity pools.
Even so, the amount moved through the six NEAR tokens represents only a small portion of the stolen funds. Elliptic estimates that about 11.8 million NEAR, worth roughly $43.7 million, remains unmoved. The firm said exchanges and compliance teams should be cautious about assuming liquidity pool funds are legitimate, especially when a pool involves a newly created token, very few active wallets, or accounts that were funded only shortly before trading began.
Source: cryptopotato.com