North Korean-linked launderers spent roughly $90 apiece to create six meme coins on the NEAR blockchain and used them to move funds stolen in the Oct. 29 hack of crypto exchange Binance, according to blockchain analytics firm Elliptic. The operation relied on self-launched tokens and liquidity pools to break the on-chain link between the stolen deposits and the wallets that received them.

Elliptic said approximately 117,000 NEAR, worth about $430,000, passed through the tokens between Nov. 5 and Nov. 7. The firm detailed the laundering operation in a report published Monday.

The scheme mirrors tactics North Korean-affiliated groups have repeatedly used after major exchange breaches, cycling funds through self-created tokens, decentralized exchanges and multiple chains to obscure their origin.

The six tokens — FUK, OLCCL, MEILI, MMLI, DABI and SINU — each cost about 25 NEAR to launch using a public token creation tool on the layer-one network. They carried cartoon meme coin artwork: one depicted a monkey wearing a pink bow, another a duck standing in front of an American flag, and a third showed Elon Musk beneath an “Elon 2028 President” banner. Elliptic noted there is no suggestion Musk has any connection to the tokens.

How the Pools Hid the Trail

The launderers paired each new token with NEAR in its own liquidity pool — a pot of two assets on a decentralized exchange that anyone can trade against. One group of wallets used stolen NEAR to buy the new token from the pool, and a second group then sold the token back and pulled NEAR out. Because the pool sat in the middle, no transfer directly linked the two groups of wallets. The route leans on a structural feature of decentralized finance: unlike regulated centralized venues, decentralized exchanges impose no know-your-customer checks or account requirements, so wallets can cycle value through a pool without identifying themselves.

“They exist only to put a pool between the stolen funds and the next wallet,” Elliptic wrote in a post on X.

North Korea’s launderers are creating their own meme coins to move funds stolen from Binance. Between November 5 and 7, they launched at least six tokens on NEAR, dressed up with meme-coin logos such as a monkey in a pink bow and a duck in front of a US flag. Stolen NEAR went… — Elliptic (@elliptic) November 9, 2026

According to Elliptic, the trading data showed the tokens had no purpose beyond laundering. Wallets tied to the operation placed every sell order in all six tokens and every buy order in five of them. The only exception was a small number of FUK purchases on launch day, which made up a sliver of that token’s trading activity.

The tokens were also linked in a chain. In five cases, the wallet that funded a new token’s creator had been selling the previous token just 2 to 13 minutes before the next launch.

A Method First Seen With Bybit

Elliptic said it first spotted the technique after Bybit lost $1.5 billion in a 2025 hack, the largest cryptocurrency theft on record, in which launderers used a worthless Tron token to move at least $24 million. In the Binance case, a similar Tron token appeared on Nov. 2, and a day later stolen SOL moved through existing Solana tokens with thin trading.

The NEAR route covers less than 0.01% of the roughly $6.3 billion taken from Binance. The FBI has attributed the theft to North Korea’s TraderTraitor hacking group, a cluster U.S. agencies have associated with the Lazarus Group. U.S. officials and United Nations experts have repeatedly identified large-scale crypto theft as a revenue stream for the sanctioned state’s weapons programs.

Elliptic said about 3,000 bitcoin, worth around $225 million, have landed in new bitcoin addresses after being converted from other stolen assets. About 11.8 million NEAR, worth $43.7 million, has not moved yet.

“The technique slows investigators down rather than hiding the funds,” Elliptic co-founder Tom Robinson wrote. He added that North Korea’s launderers “layer many cheap techniques, each adding a little more delay.”

Days before the tokens appeared, Jonty, founder of Pangolin Intelligence, said on Unchained that such networks move funds between wallets “to essentially evade the eyes of transaction monitoring software.”

Elliptic urged compliance teams not to treat funds coming out of a liquidity pool as clean by default. Warning signs include tokens that are only days old, pools with few traders, and wallets that only buy or only sell. The firm advised applying extra scrutiny to deposits traced back to pools showing those characteristics.

None of the six NEAR tokens has traded since Nov. 8. That afternoon, four of the token creators withdrew the funds still sitting in their pools, according to Elliptic. That leaves the roughly $43.7 million in dormant NEAR and the newly consolidated bitcoin as the clearest markers for analysts tracking what moves next — and, under the multi-chain pattern Elliptic has documented, another burst of self-launched tokens elsewhere would be the signal that the campaign has entered a new phase.