North Korean-linked hackers created a series of memecoins on the NEAR blockchain to help launder cryptocurrency stolen in the $6.3 billion Binance hack, according to blockchain analytics firm Elliptic. The firm said the activity took place between Nov. 5 and 7, when at least six tokens were launched and used with decentralized exchange liquidity pools to shift funds between wallets.
Elliptic said about $430,000 in stolen assets was moved through the scheme. The tokens reportedly drew almost no outside trading activity and were dropped soon after they were launched, suggesting they were created primarily as laundering tools rather than community-driven projects.
Memecoin pools used to route stolen funds
Elliptic’s account describes a simple but unusual laundering method. Rather than relying only on conventional mixers or direct wallet hops, the attackers allegedly created new tokens and paired them in decentralized exchange liquidity pools, allowing funds to be passed through a fresh onchain market structure.
The report says at least six NEAR-based tokens were involved over the three-day period. By moving assets through these pools, the hackers were able to shift part of the proceeds of the Binance theft across wallets while blending the transfers into activity that, at least on the surface, resembled token launches and trading.
A tactic with limited outside participation
The memecoins did not gain meaningful traction beyond the wallets tied to the operation, according to Elliptic. Outside trading was described as minimal, and the tokens were abandoned shortly after launch.
That pattern matters because it points to a narrow operational purpose. Instead of trying to build lasting markets or attract speculative demand, the actors appear to have used the token launches as temporary vehicles to move funds before discarding them.
Elliptic links the method to an earlier case
Elliptic said the same basic technique had already appeared after the 2025 Bybit hack. In that earlier case, the firm said North Korean-linked actors moved at least $24 million through a newly created token on the TRON blockchain after the $1.5 billion theft.
The comparison suggests the use of ad hoc tokens and liquidity pools is not an isolated experiment but part of a laundering playbook that can be adapted across different networks. In both cases, the attribution and transaction analysis come from Elliptic’s report.
Broader regional developments in tokenized assets and regulation
The source report also highlighted separate developments in Asia’s digital asset market. Payward said xStocks has expanded tokenized stock offerings in the UK and EU to 200 equities, bringing the platform’s total offering to more than 1,500 tokenized assets.
According to the company, xStocks has recorded more than $45 billion in cumulative transaction volume and over 550,000 unique holders. Payward also said hundreds of Hong Kong-listed equities are planned for addition in the coming weeks.
In Hong Kong, Deputy Secretary for Financial Services Chan Ho-lim said the government will introduce a new licensing regime covering virtual-asset trading, custody, advisory and management. The framework is expected to be advanced through amendment bills submitted to the Legislative Council this year, marking the next confirmed step in the region’s regulatory plans.
Source: cointelegraph.com