Blockchain analytics firm Elliptic has traced how funds stolen from Binance were cycled through six self-created meme coins on the NEAR blockchain in a scheme that made laundering wallets appear to be profitable traders. The findings, published in a November 9 investigation, are the firm's latest report on the theft, in which about $6.4 billion left Binance wallets on October 29. Two days later, the FBI attributed the attack to North Korea under the TraderTraitor designation it also applied to the 2025 Bybit theft. TraderTraitor is the label U.S. agencies apply to North Korean cyber groups that target cryptocurrency companies, an activity documented in repeated U.S. government advisories.

Coindoo previously covered a self-minted TRON token traced by TRM Labs, where a liquidity pool was the only connection between buyer and seller. Elliptic's NEAR findings now put numbers on both sides of a liquidity pool, across six tokens on a second blockchain.

Six Tokens With Almost No Outside Traders

Each of the six tokens was paired with NEAR in its own pool on a decentralized exchange and cost about 25 NEAR, or roughly $90, to create. Creation on a decentralized exchange is permissionless: no listing approval or identity check stands between a user and a new pool, so price is the only real barrier. At that price, a token can be used once and discarded — which is exactly what happened to all six.

A brand-new token dominated by a few wallets is not, on its own, evidence of laundering. Many legitimate launches begin that way, with the creator and a small group of early buyers doing most of the trading. Elliptic's case rests on three findings that only make sense together.

The first is who traded. Wallets in the laundering network made every sale of all six tokens and bought every unit of five of them. Purchases from outside the network came down to a handful of small buys of FUK on its first day, accounting for under 1% of that token's volume.

The second is how each token was paid for. Five of the six creators were funded by a wallet that had been selling an earlier token between 2 and 13 minutes before the new launch. One token's proceeds paid for the next, meaning the six form a chain rather than six separate bets.

The third is how briefly each token lived. Every one was first sold within three hours of launch and did at least three-quarters of its trading within a single day. None has traded since November 8, and that afternoon the creators of four of the tokens withdrew the liquidity remaining in their pools.

The figures cited here are Elliptic's. Coindoo has not independently reproduced the six pools' transaction records.

Why the Sellers Look Like Winners

Nothing about the tokens' branding stood out. Elliptic describes logos in standard meme coin style — from a monkey wearing a pink bow and a duck in front of a US flag to an "Elon 2028 President" banner over an image of Elon Musk, whom Elliptic does not connect to the tokens. The names follow the same habit: FUK is a crude joke, and SINU borrows the "-INU" ending used by dog-themed coins. The wallets carried random names assigned by a popular wallet app, so their labels linked nothing either.

Thousands of new tokens appear every day, and that is the cover. In Elliptic's reading, a wallet trading a fresh meme coin passes for a speculator unless someone checks where its money came from.

That check is where the apparent profit disappears. The buying wallets were funded with about 117,000 NEAR, passed down from the main wallet holding the stolen NEAR through intermediate accounts. Almost exactly the same amount then left the collecting wallets, much of it swapped into stablecoins or sent to a cross-chain bridge, the service that moves assets from one blockchain to another. At the prices in effect when Elliptic published, that came to roughly $430,000.

Read one collecting wallet at a time, and the record looks like a run of clean exits: tokens sold, NEAR received. Read across the network, the same NEAR went around once and came back, minus about $540 in token creation fees plus network costs. The only money that arrived from outside the network was the small FUK buying on day one.

A wallet's profit figure compares what it received with what it paid. It cannot show that the buyers on the other side were funded from the same stolen wallet. And if a seller received its tokens by transfer rather than buying them in the pool, there may be no purchase price to subtract at all.

Why Launderers Use a Trick Investigators Can Follow

Every step sits on a public blockchain, and Elliptic followed it. According to the firm, the aim is delay rather than concealment. Each extra hop takes investigators time to unpick, and laundering is a race to move funds before they are flagged. At about $90 per token, the launderers can afford to create many and throw each one away.

The playbook is not new. Elliptic first observed home-made tokens in the laundering of the 2025 Bybit theft, when at least $24 million moved through a worthless TRON token. In the Binance case, it identified a similar TRON token on November 2. A day later, it saw stolen SOL routed through thinly traded existing tokens on Solana before being sold for USDC and bridged out. TRM Labs described the same TRON pattern in its own tracing.

The NEAR sums are small next to what remains. About 11.8 million NEAR, worth roughly $43.7 million, had not moved as of Elliptic's report, and the firm argues the technique is cheap enough to carry far larger amounts. For anyone following the case, the concrete markers from here are updates to Elliptic's public blocklist as new laundering addresses are confirmed, and any first movement out of that untouched balance. Elliptic also stresses that the launch tool, the exchange, and the wallet app did nothing wrong; the launderers used them the way any other user could.

Five Checks Before Trusting a Wallet's Winning Streak

Wallet trackers and copy-trading feeds routinely surface accounts with large realized gains. Elliptic's warning signs for compliance teams carry over directly, and a block explorer is enough to run them:

1. Token age. Check when the token contract was created. Large sells within days of launch deserve a closer look.
2. Trader count. Open the pool's trade history. A handful of wallets doing nearly all the volume means few real counterparties.
3. One-way wallets. Look for wallets that only buy alongside wallets that only sell. That split is one of Elliptic's red flags.
4. Fresh funding. Trace the first deposit into the main buyers. New wallets funded just before trading begins, often in round amounts, are a warning sign.
5. Liquidity pulled. See whether the creator withdrew what was left in the pool soon after trading stopped.

A single flag describes much of the meme coin market. Several on the same wallet mean its profit figure needs the buyers' side of the ledger examined before anyone copies its trades.

For exchanges, Elliptic's advice is that funds arriving from a liquidity pool should not be treated as clean by default. Its public blocklist of wallets tied to the Binance hack grows as new addresses are identified, so a deposit that passed screening on arrival can be flagged later. Elliptic tells firms to recheck deposits they have already accepted each time the list is updated.