North Korean hackers laundered Binance hack funds via NEAR memecoins, Elliptic says

How the memecoin loop worked

Between Nov. 5 and 7, the hackers created at least six tokens on NEAR and used liquidity pools on decentralized exchanges to move stolen funds between wallets, Elliptic said. The mechanics aren't complicated. One set of wallets swapped stolen NEAR for the new memecoins, and another set sold those memecoins back into the pools for NEAR.

So why bother with tokens nobody trades?

The swaps let the hackers move funds without direct wallet-to-wallet transfers, according to Elliptic (though the transactions remained traceable onchain). The tokens attracted almost no outside trading and were abandoned shortly after launch.

Elliptic also found that five of the six token creators were funded with proceeds from earlier token sales two to 13 minutes before the next launch. That's what links the tokens in a chain of transactions, per the firm's report.

A playbook Elliptic has seen before

It isn't the first time. Elliptic said the same technique was used after the $1.5 billion Bybit hack in 2025, when North Korean-linked actors moved at least $24 million through a newly created token on the TRON blockchain.

Elliptic co-founder Tom Robinson wrote in the report that North Korea's launderers rarely rely on a single technique, and that they instead stack many cheap ones on top of each other.

“Instead, they layer many cheap techniques, each adding a little more delay.”

What's still sitting in the wallets

At the time of Elliptic's analysis, about 11.8 million NEAR stolen in the Binance hack remained unmoved. Elliptic valued that stash at $43.7 million.

That's a much bigger pile than the roughly $430,000 Elliptic traced through the six memecoins, and the firm's findings, as reported by Cointelegraph, put the NEAR-based laundering alongside the Bybit-era TRON token as the same kind of low-cost layering Robinson described.