Blockchain analytics firm Elliptic reported that wallets linked to the Binance hack were used to mint and trade six meme tokens on NEAR, with decentralized exchange (DEX) liquidity pools deployed in an alleged effort to obscure the flow of stolen funds.

Elliptic and the FBI attributed the theft to TraderTraitor, a North Korean cybercrime group operating under the Lazarus Group umbrella — a collective long linked by U.S. investigators to large-scale cryptocurrency thefts. According to the firm, the incident involved $6.43 billion taken from Binance, the world's largest cryptocurrency exchange by trading volume, on October 29, 2026, and dispersed across 11 blockchains, in what Elliptic described as an unprecedented compromise of a single exchange.

Six Themed Tokens Minted on NEAR

Between November 5 and November 7, 2026, six tokens were minted on NEAR: FUK, OLCCL, MEILI, MMLI, DABI, and SINU. NEAR is a layer-one blockchain that supports low-cost token creation. Elliptic's on-chain analysis found that the tokens carried cartoon animal logos — including a bow-wearing monkey, a flag-draped duck, a chimpanzee, and a fox — alongside an image labeled “Elon 2028 President.” Each token cost approximately 25 NEAR, or around $90 at the time, to mint.

How the Alleged Laundering Mechanism Worked

Elliptic described the scheme as proceeding in four steps. First, a new token and a decentralized exchange liquidity pool are created. Funds identified as stolen then enter from one set of wallets to buy the token. A separate set of wallets sells the token back into the pool to withdraw assets. The effect is that the direct on-chain link between the original funds and the exit wallet is broken.

The firm noted that DABI, MMLI, and SINU each had exactly one buying wallet and one selling wallet — a pattern Elliptic said was consistent with controlled laundering rather than organic trading activity.

All liquidity was pulled on November 8, 2026, according to Elliptic. Outside trading across all six tokens amounted to less than 1% of total volume, reinforcing the firm's assessment that these were not speculative retail tokens but instruments engineered to move value. Approximately 117,000 NEAR, worth around $430,000 at the time, moved through the six tokens.

The same technique was reportedly first deployed during the Bybit hack in February 2025 — an incident that ranks among the largest crypto thefts on record — when at least $24 million moved through a worthless token on the Tron network. Its reappearance in the Binance hack, following the Bybit precedent, marks home-made meme tokens as a repeatable laundering technique rather than a one-off — the pattern underlying the compliance red flags Elliptic asked crypto businesses to watch for.

Laundering Activity Extended Beyond NEAR

Elliptic reported that the meme coin activity on NEAR was not isolated. The firm also documented a worthless Tron token used on November 2, and said that on November 3, SOL it identified as stolen was swapped into thinly-traded Solana tokens and then sold for USDC, a dollar-backed stablecoin issued by Circle, adding further complexity to the trail across multiple chains.

“One More Layer”: Why Meme Coins Complicate Tracing

Tom Robinson, co-founder of Elliptic, explained the strategic logic: “Meme coins are launched and traded in their thousands, and most fade within days, so one more short-lived token with a cartoon logo attracts little attention. A wallet whose history shows trades in a new meme coin looks like a speculator rather than a launderer, unless someone checks where its money came from.”

Robinson also framed the technique's limits: “Home-made meme tokens are simply one more layer. It does not hide the funds so much as slow down the people tracing them.” Blockchain transactions remain publicly visible regardless of how many intermediate assets they pass through, but each hop adds investigative work and time.

Elliptic reported that a broader alleged laundering operation was running at a scale that made the meme coin activity look like a minor test. Elliptic's separate report on automated laundering tracked 546 transfers from a single wallet firing approximately every 96 seconds, moving $7 million to $11 million per hour without pause for more than 31 hours. The firm identified more than 20,000 wallets and 16 chains it said were involved in the operation, which the FBI formally attributed to TraderTraitor.

Compliance Red Flags

Elliptic warned crypto businesses to treat the meme coin pattern as a compliance red flag, citing freshly minted tokens, liquidity pools with only a handful of wallets, wallets that only buy versus wallets that only sell, and new wallets funded just before trading in round amounts. The firm cautioned that funds arriving through liquidity pools should not be treated as inherently clean.

Frozen Funds, Recovery Efforts, and Market Context

Binance co-CEO Richard Teng confirmed that $2.85 billion in stolen funds had been frozen or intercepted as of Elliptic's reporting. Roughly $3.2 billion remained unlaundered at that time, with recovery efforts ongoing across multiple jurisdictions and chains. The response from U.S. authorities drew public acknowledgment from exchange leadership. For readers tracking how the remaining funds are resolved, the observable markers are those already on record: further freeze or interception confirmations from the exchange and authorities, updates to screening lists such as the blocklist below, and the on-chain flows documented in Elliptic's research.

Elliptic published a free blocklist of illicit addresses from the Binance hack at elliptic.co/binance-hack-2026-blocklist to help exchanges, wallets, and DeFi protocols screen incoming funds. The firm did not confirm or deny whether AI agents are directing the operation; its assessment pointed to conventional automation with human oversight rather than autonomous AI decision-making.

The broader market dislocation from the hack continued to show up across token ecosystems weeks after the initial theft, with NEAR trading at $3.62 and a market capitalization of approximately $4.75 billion at the time of Elliptic's research. The episode is also a reminder that infrastructure built for legitimate token launches — cheap minting, public DEX pools, and rapid liquidity deployment — can be repurposed as obfuscation tooling at near-zero cost.

Users seeking account-security updates should rely on official Binance communications rather than third-party reporting.