North Korea-linked launderers used self-issued meme tokens and decentralized exchange liquidity pools to move crypto assets stolen from Binance, according to blockchain analytics firm Elliptic, as reported by BlockBeats on November 9, 2026.
Elliptic said the arrangement avoided a direct transfer from wallets holding stolen assets to receiving wallets. It identified the technique on Tron and NEAR, with a similar approach also appearing on Solana. The firm stressed that the method does not conceal where funds go, but increases the time needed to trace them on-chain.
Routes through tokens and liquidity pools
On November 2, Elliptic identified worthless tokens on Tron that it said had been created specifically to launder funds from the Binance theft.
The following day, stolen SOL was exchanged for wrapped and thinly traded tokens, which were then sold for USDC. The USDC was subsequently moved across chains. The report did not identify the destination chains or bridges used.
On November 5–7, the launderers minted at least six meme tokens on NEAR: FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each was paired with NEAR in a separate liquidity pool, with a reported creation cost of about 25 NEAR, or roughly $90, per pool.
Approximately 117,000 stolen NEAR, valued at about $430,000 at the prices cited in the report, moved through these tokens. Receiving wallets then transferred out almost equivalent amounts, with most of those funds going into stablecoins or cross-chain bridges.
The six tokens had recorded no trades since November 8. That afternoon, the creators of four of them withdrew the remaining liquidity from their pools.
Earlier precedent and funds still unmoved
Elliptic said it first observed a similar technique during the laundering of funds stolen from Bybit in 2025. In that case, launderers minted worthless tokens on Tron and paired them with stablecoins in liquidity pools, moving at least $24 million.
At the time of the November 9 report, approximately 11.8 million NEAR, valued at about $43.7 million, remained unmoved among the stolen funds.
The reported cross-chain transfers were downstream steps in the laundering routes. The source did not specify bridge verification mechanisms or destination-chain outcomes beyond the transfers described above.
Original publication: November 9, 2026, at 21:51:27 (UTC+8).
Source: BlockBeats, citing Elliptic
