Blockchain analytics firm Elliptic reported on Monday that North Korean hackers used disposable memecoins to route assets stolen from Binance, a technique it said raises screening risks for firms that receive funds from decentralized liquidity pools.

In its November 9 analysis, Elliptic traced 117,000 NEAR (the native token of the NEAR layer-one blockchain), worth $430,000, through six tokens. Each token cost approximately 25 NEAR, or $90, to create. The firm said the transfers remained traceable despite the added transaction steps.

How Disposable Tokens Obscured the Origin of Funds

Between November 5 and 7, the laundering wallets launched six tokens on NEAR, Elliptic found. Each was paired with NEAR in a separate decentralized exchange liquidity pool, where trades settle against pooled reserves rather than between named counterparties. One set of wallets bought the tokens using stolen NEAR, while another sold the same tokens to recover the funds, leaving no direct transfer between the two wallet groups.

Elliptic said the pattern could make receiving wallets resemble profitable traders. However, network data linked the buyers, sellers, and token creators to the same stolen funds. Five of the token creators received funding from wallets that had sold earlier tokens just two to thirteen minutes beforehand, according to the firm. Outside wallets accounted for less than 1% of the trading volume in one token, and the other five had no outside buyers at all.

All six tokens stopped trading by November 8, and four issuers withdrew the remaining liquidity that afternoon. Elliptic identified approximately 11.8 million stolen NEAR that remained unmoved at the time of its reported snapshot, leaving that balance the clearest marker for anyone tracking the case, since the firm found the technique kept transfers traceable onchain.

Why Liquidity Pool Deposits Require Closer Checks

Elliptic warned that funds emerging from liquidity pools should not automatically receive a clean classification. Because pooled markets route every swap through shared reserves, a deposit's immediate onchain source is the pool itself rather than the party on the other side of the trade. It identified recently created tokens, concentrated trading, and single-purpose wallets as potential warning signs.

According to the firm, the approach did not conceal every onchain movement. Instead, it created additional tracing work while the stolen assets continued crossing networks.

Elliptic documented a related tactic after the 2025 Bybit breach, one of the largest cryptocurrency thefts on record, reporting that at least $24 million passed through a worthless token on Tron. In the Binance case, it observed another homemade Tron token on November 2, and the following day attackers routed stolen SOL through existing thinly traded tokens.

Binance Hack Investigation Continues

The FBI attributed the October 29 theft to North Korea's TraderTraitor operation, a state-linked hacking cluster that U.S. agencies have tied to earlier cryptocurrency exchange thefts. Pyongyang has denied responsibility.

As Blockonomi previously reported, the attackers accessed Binance's wallet infrastructure after compromising employee devices. A separate Blockonomi report covered the FBI's attribution and the early movement of the stolen cryptocurrency.

Binance said on November 3 that the incident affected approximately $6.34 billion. It reported that around $2.85 billion had been frozen or intercepted and that 98% of affected assets had been replenished. Those replacements were funded by Binance itself, not from recovered loot.