North Korea-linked hackers are creating their own memecoins to disguise the origin of funds stolen from Binance, according to an analysis by blockchain firm Elliptic published on November 9. So far, about 117,000 NEAR, or roughly $430,000, has passed through such tokens.
Elliptic, a company specializing in blockchain analysis, describes a technique it had earlier observed in laundering proceeds from the 2025 attack on the Bybit exchange. This time it concerns the theft from Binance on October 29, which Elliptic estimates at $6.4 billion. The FBI has named the North Korean group TraderTraitor as the perpetrator. Earlier, we reported that after the attack, customers withdrew a net $5.3 billion from the exchange.
Six tokens on the NEAR network
Between November 5 and 7, the attackers created at least six new memecoins on the NEAR network: FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each cost about 25 NEAR (around $90) and was paired with NEAR in its own liquidity pool on a decentralized exchange. One of the tokens had a logo featuring Elon Musk and the slogan “Elon 2028 President”; Elliptic stresses that nothing indicates his connection to these tokens.
How the method works
One group of wallets deposited the stolen funds into the pool and received the token in return. A second group sold that token back into the pool and withdrew “clean” NEAR. The funds therefore do not move directly from wallet to wallet, and the recipients look like ordinary traders who profited from trading.
According to Elliptic, almost no one outside the hacker network traded these tokens: the only external activity was small FUK purchases on the first day, below 1% of its turnover. Each token was used immediately and then abandoned; none of the six was listed after November 8, and the creators of four withdrew the remaining liquidity. Five of the six wallets that created tokens were funded from a previous token, 2–13 minutes before the next one launched.
A total of about 117,000 NEAR went into the pools, and almost the same amount flowed out of the receiving wallets, largely into stablecoins or onto a cross-chain bridge. About 11.8 million NEAR ($43.7 million) from the theft has not yet been moved.
Tron and Solana
Elliptic notes that a similar, worthless token appeared on the Tron network on November 2. A day later, stolen SOL was swapped on Solana for poorly traded tokens, then for USDC, and moved to other networks. In the case of Bybit in 2025, at least $24 million was passed through in this way.
Elliptic emphasizes that the trail remains visible on the blockchain — the method slows investigators down but does not conceal the funds. The firm advises institutions not to treat inflows from liquidity pools as clean, especially when newly created tokens are involved, and publicly shares a list of addresses linked to the attack.
