Blockchain analytics firm Elliptic has identified an unusual laundering technique used by the hackers responsible for the $6.43 billion Binance hack: instead of moving stolen assets directly between wallets, the attackers minted their own meme coins and traded them through decentralized exchange (DEX) liquidity pools before abandoning the tokens entirely.

The FBI has attributed the breach to North Korea's TraderTraitor group, a designation U.S. authorities use for state-sponsored North Korean cyber actors that target the cryptocurrency industry. According to Elliptic's analysis, the newly created tokens acted as a sacrificial buffer between the wallets holding the stolen crypto and the addresses ultimately receiving the proceeds. The technique remains discoverable on-chain, but it can slow investigators down and complicate compliance screening.

Six Meme Coins Moved 117,000 Stolen NEAR

The laundering network, established between Nov. 5 and Nov. 11, produced at least six tokens on the NEAR blockchain: FUK, OLCCL, MEILI, MMLI, DABI and SINU, according to Elliptic. The firm estimates that approximately 117,000 NEAR, valued at around $430,000, was processed through liquidity pools tied to these tokens. Creating each token cost roughly $90, making the intermediary layer cheap to stand up relative to the sums being moved.

The coins saw virtually no genuine market trading. Wallets that appeared to be part of the laundering operation carried out all sales across all six tokens and nearly all of the purchases, Elliptic determined. Most of the tokens were sold off and dumped within hours, and no trading activity has occurred since Nov. 8 — the day after Elliptic released its analysis.

How the Disposable Token Route Works

The scheme inserts a laundering layer between the stolen crypto and the wallet that ultimately collects the proceeds. First, the attackers create a new token and pair it with an established asset such as NEAR in a DEX liquidity pool. Stolen NEAR held in one wallet is then used to purchase the freshly minted token. A separate wallet subsequently sells that token back into the pool and withdraws NEAR.

As a result, the stolen assets never move directly from the first wallet to the address that collects them. At face value, the receiving wallet appears simply to have acquired funds by trading an obscure meme coin — and because DEXs let any wallet trade newly issued tokens without intermediary vetting, such an address can pass for an ordinary meme coin trader until the pattern itself is recognized.

The blockchain trail is still visible, however. Elliptic said the strategy creates friction for investigators rather than making the stolen funds untraceable.

Binance Hack Laundering Spans Multiple Chains

The NEAR activity is only one component of a much larger laundering operation surrounding the Binance hack. Elliptic has tracked the stolen proceeds through more than 20,000 wallets, across 16 blockchains, involving at least 36 services and around 65,000 transactions. The firm reported approximately $3 billion sitting in addresses it believes are linked to stolen funds.

Comparable token-based approaches have also been implemented on other blockchain systems, such as Tron and Solana. Elliptic additionally connected the technique to the 2025 Bybit hack, in which North Korean-affiliated thieves allegedly funneled more than $24 million through an illusory token launched on the Tron network. Recurring across separate incidents and chains, the technique has become a recognizable pattern that screening tools can be built to detect, and any future movement of the roughly $3 billion in traced funds would remain visible on-chain.

For crypto compliance teams, one new red flag has emerged: funds entering the system from a liquidity pool on a decentralized exchange that has only just been launched and shows minimal trading volume. That signal comes from the same public on-chain data Elliptic used to trace the operation — the tokens minted to break the direct wallet-to-wallet link now double as markers that automated monitoring can screen for.