Launderers linked to the $6.4 billion Binance theft used newly created meme coins to move a portion of the stolen crypto through decentralized exchange liquidity pools, according to blockchain analytics firm Elliptic, as reported by Decrypt on November 10, 2026.
Elliptic attributed the activity to North Korean hackers and said the technique disrupted the direct onchain link between wallets spending stolen funds and wallets collecting the proceeds. It did not make the funds untraceable.
Six tokens moved roughly $430,000 on Near
In research credited to Elliptic co-founder Tom Robinson, the firm described activity on Tron and Near, with a similar approach on Solana.
The clearest example involved at least six tokens created on Near between November 5 and 7. Each was paired with NEAR in a separate liquidity pool and cost about 25 NEAR—roughly $90—to create.
The tokens used familiar meme-coin imagery, including cartoon animals and an “Elon 2028 President” image. Elon Musk had no connection to the tokens. Names included FUK and SINU.
According to Elliptic, all six tokens were launched, traded heavily within hours using stolen NEAR, and then abandoned. Remaining liquidity was withdrawn on November 8. About 117,000 NEAR, worth roughly $430,000, passed through the pools before much of it moved into stablecoins or a cross-chain bridge.
Liquidity pools added a layer, not anonymity
The scheme used one set of wallets to buy the newly minted tokens with stolen assets and another set to sell tokens into the pools and collect the underlying assets. With the liquidity pool between the two groups, there was no direct transfer of stolen funds from the buying wallets to the collecting wallets. The recipients could therefore resemble ordinary traders selling a meme coin.
Elliptic stressed that the trail remained fully traceable onchain. The added layer slowed investigators, giving launderers more time to move assets before they were flagged.
The amounts identified in these six pools represented only a small portion of the reported theft. Elliptic had previously found that more than $3 billion in stolen crypto remained unlaundered and that the launderers were creating a new wallet roughly every 25 seconds.
A technique seen in the Bybit investigation
Elliptic said it first observed the tactic in 2025 while tracing the $1.5 billion Bybit theft. That theft was also attributed to TraderTraitor, the group identified as responsible for the Binance breach.
For compliance teams, Elliptic’s warning was that assets received from a liquidity pool should not automatically be treated as clean—particularly when newly minted tokens and a small group of trading wallets are involved.
Original publication: November 10, 2026, at 03:36:02 UTC+8.
Source: Decrypt’s original article.