North Korean hackers used NEAR memecoins to launder $430K, Elliptic says
In brief
- North Korean hackers routed roughly $430,000 through six new NEAR memecoins, Elliptic says.
- Six tokens were created between Nov. 5 and 7 and paired with DEX liquidity pools.
- Two wallet sets swapped NEAR into the memecoins, then sold them back for NEAR.
- The memecoins drew almost no outside trading and were abandoned soon after launch.
- Elliptic said the same method was used after the $1.5 billion Bybit hack in 2025.
How the NEAR memecoin loop worked
Between Nov. 5 and 7, the hackers created at least six tokens on NEAR and used liquidity pools on decentralized exchanges to move stolen funds between wallets, Elliptic said. It's a simple loop. One set of wallets swapped stolen NEAR tokens for the new memecoins, and a second set sold those memecoins back into the pools for NEAR (so the money went in through one door and came out through another).
Why bother with memecoins at all?
According to Elliptic, the swaps let the hackers move funds without direct wallet-to-wallet transfers. That didn't make the money invisible, though. The firm said the transactions remained traceable onchain, which is how the pattern surfaced in the first place.
Tokens nobody else traded
The memecoins weren't built to attract buyers. Per the report, the tokens drew almost no outside trading and were abandoned shortly after launch, which fits the role they played in the scheme: a temporary pass-through sitting in a defi liquidity pool, used by the same people on both sides of the trade.
Launch, swap, sell back, abandon.
A playbook Elliptic has seen before
Elliptic said the same laundering technique was used after the $1.5 billion Bybit hack in 2025. In that case, North Korean-linked actors moved at least $24 million through a newly created token on TRON, according to the firm.
The NEAR episode is much smaller in dollar terms (roughly $430,000 against at least $24 million in the Bybit case). What carries over, by Elliptic's account, is the method itself: a freshly minted token on a public chain, used to move stolen funds between wallets the hackers control. The chain changes, but the method doesn't.
And because every swap stayed onchain, Elliptic was able to follow it.
Frequently asked questions
How did the hackers use memecoins to launder funds on NEAR?
According to Elliptic, the hackers created at least six tokens on NEAR between Nov. 5 and 7 and paired them with liquidity pools on decentralized exchanges. One set of wallets swapped stolen NEAR for the memecoins, and another set sold the memecoins back into the pools for NEAR.
Could the laundered funds still be traced?
Yes. Elliptic said the swaps let the hackers avoid direct wallet-to-wallet transfers, but the transactions remained traceable onchain.
Has this laundering technique been used before?
Elliptic said the same technique was used after the $1.5 billion Bybit hack in 2025, when North Korean-linked actors moved at least $24 million through a newly created token on TRON.
