Launderers linked to North Korea used newly created meme coins and decentralized exchange liquidity pools to move part of the reported $6.4 billion stolen from Binance, according to Elliptic research covered by Decrypt. Some proceeds subsequently moved into stablecoins or a cross-chain bridge, but Elliptic said the transactions remained fully traceable onchain.
Source publication time: Decrypt published the article on November 10, 2026, at 03:36:02 UTC+8. That timestamp belongs to the article, not to Elliptic’s research.
How the liquidity-pool handoff worked
According to Elliptic’s research, credited to co-founder Tom Robinson, the launderers created otherwise worthless tokens and paired them with assets such as NEAR or stablecoins in liquidity pools. One set of wallets used stolen funds to buy the new tokens; a separate set sold those tokens into the pools to collect the paired assets.
The pool stood between the buying and collecting wallets, avoiding a direct transfer of stolen funds between them. That made the receiving wallets resemble ordinary traders cashing out a meme coin—not proof that the proceeds were legitimate.
Elliptic identified the tactic on Tron and Near, with a close variant on Solana.
The Near route: six tokens, then stablecoins or a bridge
Between November 5 and 7, the launderers created at least six tokens on Near, each with its own NEAR liquidity pool. Each token cost about 25 NEAR, roughly $90, to create.
Their branding included a bow-wearing monkey, a flag-draped duck, a chimpanzee and a fox. One used an “Elon 2028 President” image of Elon Musk, who had no connection to the tokens. Token names included FUK and SINU.
All six followed the same pattern: launch, heavy trading within hours using stolen NEAR, and abandonment. The remaining liquidity was withdrawn on November 8.
About 117,000 NEAR—roughly $430,000—passed through the six tokens. Much of that subsequently flowed into stablecoins or a cross-chain bridge. The supplied article does not identify the bridge, its verification mechanism or the destination chain, so it does not establish how that cross-chain handoff was secured or what assets emerged on the other side.
A traceable detour, not erased provenance
Elliptic stressed that the maneuver slowed investigators rather than concealing the onchain trail. It was one inexpensive, disposable layer in a broader effort to move funds before they could be flagged.
The firm had previously found that more than $3 billion of the stolen cryptocurrency remained unlaundered and that the launderers were creating a new wallet roughly every 25 seconds. The amount routed through the six Near tokens was therefore a modest portion of the reported theft.
Elliptic first observed the tactic the previous year while tracing the $1.5 billion Bybit theft, which was also attributed to TraderTraitor, the group linked to the Binance breach.
For compliance teams, Elliptic’s warning was that receipt from a liquidity pool should not be treated as evidence of clean funds—particularly when newly minted tokens and a small set of trading wallets are involved.
