Six meme coins created on NEAR helped North Korean hackers move stolen funds, with almost no genuine trading activity involved.
North Korean hackers are creating their own meme coins to move stolen stash from the Binance hack, according to blockchain analytics firm Elliptic.
The attackers are using newly launched tokens and decentralized exchange liquidity pools to move funds between wallets without making direct transfers.
Binance Laundering Tactic
Elliptic flagged the activity on Tron and NEAR, along with a similar method on Solana. The process involves creating a token, pairing it with a legitimate crypto such as NEAR or a stablecoin, and adding it to a liquidity pool on a decentralized exchange.
The attackers then use one set of wallets to buy the newly created token with stolen funds. A separate group of wallets sells those tokens back into the pool and receives the original crypto. This puts the liquidity pool between the wallets, which makes it harder to immediately connect the funds entering the pool with those coming out.
The blockchain analytics firm said it first identified the method while tracking funds stolen from Bybit in 2025. In that case, North Korean launderers created a worthless token on Tron and used it to move at least $24 million through a liquidity pool. The same approach appeared again shortly after the Binance theft.
On November 2, Elliptic identified a newly created token on Tron that appeared to have been launched specifically for laundering. The following day, stolen Solana (SOL) was exchanged for wrapped and thinly traded tokens before being converted into USDC and transferred to other blockchains. The activity on NEAR provided the clearest evidence of the method.
Between November 5 and 7, the attackers created six tokens named FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each was paired with NEAR in a separate liquidity pool. Creating a token cost around 25 NEAR, or approximately $90. The six tokens were then used to move around 117,000 NEAR, worth roughly $430,000. According to Elliptic, the wallets buying these tokens received their funding from stolen NEAR.
You may also like:
Almost the same amount later came out through separate wallets, and much of it was converted into stablecoins or transferred through a cross-chain bridge. The transaction patterns also showed that the tokens were not being traded by regular investors. Wallets connected to the laundering operation handled almost all the buying and selling. Three tokens, DABI, MMLI, and SINU, each had just one buying wallet and one selling wallet. The tokens were traded heavily shortly after launch and then abandoned. None of the six has recorded further trading activity since November 8.
Funds Still Traceable
Elliptic also found that proceeds from previously launched tokens were used to fund the creation of newer ones, connecting the six-token operation. The method does not remove the transaction trail from the blockchain. Investigators can still follow the funds, but the additional swaps and wallets make the process more time-consuming.
At around $90 per token, the cost of creating new ones is low. This allows the attackers to repeat the process with different tokens. The $430,000 moved through the six NEAR tokens represents only a small portion of the stolen funds. Elliptic estimates that around 11.8 million NEAR, worth approximately $43.7 million, remains unmoved.
The firm has also warned crypto exchanges and compliance teams against automatically treating funds received from liquidity pools as legitimate. Newly created tokens, pools with very few participating wallets, and accounts funded shortly before trading could indicate laundering activity.
