North Korea-linked attackers are using newly created meme tokens and decentralised exchange (DEX) liquidity pools to move cryptocurrency stolen in the roughly $6.4 billion Binance hack, according to blockchain analytics firm Elliptic.

Between November 5 and 7, the operation routed approximately 117,000 NEAR, worth around $430,000, through at least six tokens created specifically for the activity. Meme tokens, which typically exist for trading and community interest rather than any underlying utility, can be issued at minimal cost, making them convenient throwaway vehicles for this kind of routing. The technique adds layers of complexity to transaction tracing without removing the funds' on-chain history.

Six NEAR Meme Tokens Mapped to the Laundering Flow

In a November 9 investigation, Elliptic identified six meme tokens created between November 5 and 7: FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each token was paired with NEAR in a separate liquidity pool — a smart-contract reserve of two tokens on a decentralised exchange that allows automated swaps without a traditional order book — allowing the attackers to exchange stolen NEAR for newly issued tokens and later convert those tokens back into NEAR through other wallets. Elliptic estimated that creating each token cost approximately 25 NEAR, or about $90.

The analytics firm traced around 117,000 NEAR, valued at approximately $430,000, through the six token pools. It found that wallets linked to the operation controlled almost all of the buying and selling activity, with little evidence of genuine outside demand. The tokens were used shortly after creation and then abandoned, and the creators of four of them withdrew the remaining pool liquidity on November 8. Elliptic's investigation details the on-chain findings.

Liquidity Pools Complicate the Tracing of Stolen Crypto

The technique works by placing a newly created token between the wallets that receive stolen funds and those that collect the assets after the swaps. One group of wallets exchanges stolen NEAR for the new token, while another group sells that token through the pool to receive NEAR. As a result, the funds never move directly between the buying and collecting wallets, making the transaction trail more difficult to interpret.

The method does not, however, erase the blockchain record or render the funds untraceable. Elliptic said the transactions remain visible, but each additional swap and wallet creates more work for investigators and compliance teams. The firm also warned that cryptocurrency businesses should not automatically treat funds received from liquidity pools as legitimate, particularly when newly created tokens and unusual trading patterns are involved.

Binance Theft Investigation Reveals a Wider Laundering Operation

The NEAR activity is part of a much larger effort to move assets stolen in the October 29 Binance incident. Elliptic estimated the theft at approximately $6.43 billion and said the laundering operation has involved more than 20,000 wallets across 16 blockchains, alongside at least 36 services and 65,000 transactions. The FBI attributed the attack to North Korea's TraderTraitor group, according to Elliptic's investigation. TraderTraitor is a designation U.S. authorities have used for North Korea-linked cyber actors behind cryptocurrency thefts targeting the industry.

As of its November 7 update, Elliptic reported that approximately $2.85 billion had been frozen or seized, while around $3.13 billion remained in addresses linked to the theft. The firm also identified earlier laundering activity involving Tron and Solana, showing that the attackers have used multiple blockchains and transaction methods. Elliptic's Binance hack investigation tracks the movement of the stolen assets.

Bybit Precedent Raises Concerns for Crypto Compliance Teams

Elliptic said it had previously observed a similar technique during the laundering of funds stolen in the 2025 Bybit hack. In that case, attackers created an unwanted token on Tron and used a stablecoin liquidity pool to move at least $24 million. The recurrence suggests that creating temporary tokens and routing funds through DEX pools has become another method in the laundering playbook attributed to North Korea-linked actors.

The findings raise concerns for exchanges, decentralised finance platforms and compliance providers that monitor suspicious crypto deposits. Screening only the wallet that sends funds may be insufficient when assets arrive through a liquidity pool, because the preceding swaps can conceal links to illicit activity from a basic review.

Elliptic said the NEAR operation involved approximately $430,000, while around 11.8 million NEAR, worth about $43.7 million at the time of its report, remained unmoved. Further movement of those funds could provide investigators with additional evidence about the operation.