Elliptic says North Korea-linked hackers used NEAR memecoins to launder Binance funds
In brief
- Hackers created at least six NEAR tokens between Nov. 5 and 7, according to Elliptic.
- Roughly $430,000 in Binance hack funds was routed through the tokens, per Elliptic.
- Liquidity pool swaps replaced direct wallet transfers but remained traceable onchain.
- About 11.8 million NEAR, valued by Elliptic at $43.7 million, remained unmoved.
How the token scheme worked
Cointelegraph, which reported Elliptic's findings, described the Binance incident as a $6.3 billion hack. That's background here. The report itself zooms in on a much smaller slice of the money.
The mechanics are simple. Elliptic said the hackers used one set of wallets to swap stolen NEAR for the new memecoins, then used another set to sell those memecoins back into the pools for NEAR. It's a way to shift funds without direct wallet-to-wallet transfers (though the transactions remained traceable onchain, according to the firm).
None of the tokens had real traction. They attracted almost no outside trading and were abandoned shortly after launch.
A chain of launches
Elliptic also found that five of the six token creators were funded with proceeds from earlier token sales two to 13 minutes before the next launch. That tight timing is what linked the tokens together in a single chain of transactions.
“North Korea’s launderers rarely rely on a single technique,” Elliptic co-founder Tom Robinson wrote in the report. “Instead, they layer many cheap techniques, each adding a little more delay.”
Each step is cheap. The delay is the point.
Not the first time
Elliptic said the same laundering technique was used after the $1.5 billion Bybit hack in 2025, when North Korean-linked actors moved at least $24 million through a newly created token on TRON. The NEAR episode is far smaller in dollar terms, but the playbook (spin up a token, cycle funds through a pool, abandon it) looks the same in Elliptic's telling.
A far bigger pile of stolen NEAR hadn't moved as of Elliptic's analysis.
At the time of Elliptic's analysis, about 11.8 million NEAR stolen in the Binance hack remained unmoved, which the firm valued at $43.7 million. That's a much bigger pile than the roughly $430,000 Elliptic traced through the memecoins, and it's sitting onchain where analytics firms can watch it.
Frequently asked questions
How did the hackers use memecoins to move stolen NEAR?
According to Elliptic, the hackers used one set of wallets to swap stolen NEAR for newly created memecoins, then used another set to sell those memecoins back into liquidity pools for NEAR. The swaps let them move funds without direct wallet-to-wallet transfers, though the transactions remained traceable onchain.
How much NEAR from the Binance hack hasn't moved yet?
At the time of Elliptic's analysis, about 11.8 million NEAR stolen in the Binance hack remained unmoved. Elliptic valued that amount at $43.7 million, compared with the roughly $430,000 it traced through the six memecoins.
