North Korean hackers used newly created meme coins to move a small portion of the reported $6.4 billion stolen from Binance, according to blockchain analytics firm Elliptic. The tokens’ cartoon animals and Elon Musk imagery supplied a familiar meme-coin wrapper—but the activity described by Elliptic was laundering, not evidence of genuine community demand.
The findings were covered in Decrypt’s original article, published November 10, 2026, at 03:36:02 UTC+8.
A liquidity pool between the wallets
Elliptic’s research, credited to co-founder Tom Robinson, described a scheme in which launderers created tokens with no underlying value and paired them with assets such as NEAR or stablecoins in decentralized-exchange liquidity pools.
One set of wallets used stolen funds to buy the tokens. A separate set sold tokens into the pools to collect the paired assets. With a liquidity pool between the buying and collecting wallets, there was no direct transfer of stolen funds between them, making the recipients look more like ordinary traders cashing out.
That did not erase the trail. Elliptic said the transactions remained fully traceable onchain; the extra steps slowed investigators and bought time before funds could be flagged.
Six Near tokens moved roughly $430,000
Elliptic identified the tactic on Tron and Near, with a close variant on Solana. Its clearest example involved at least six tokens created on Near between November 5 and 7, each with its own NEAR liquidity pool.
Their branding included a bow-wearing monkey, a flag-draped duck, a chimpanzee and a fox. Another used an “Elon 2028 President” image. Musk had no connection to the tokens. Names included FUK and SINU.
Each token cost about 25 NEAR—roughly $90—to create. All six were launched, traded heavily within hours using stolen NEAR, and then abandoned. The remaining liquidity was withdrawn on November 8.
About 117,000 NEAR, worth roughly $430,000, passed through the six tokens. Much of that subsequently moved into stablecoins or a cross-chain bridge.
Trading activity was not proof of organic interest
The amounts identified in these pools were small relative to the reported theft. Elliptic had previously found that more than $3 billion in stolen crypto remained unlaundered, while the launderers were creating a new wallet roughly every 25 seconds.
The firm first observed this meme-coin tactic in 2025 while tracing the $1.5 billion Bybit theft, which was also attributed to TraderTraitor, the group linked to the Binance breach.
For compliance teams, Elliptic’s warning was straightforward: funds coming from a liquidity pool should not automatically be treated as clean, particularly when newly minted tokens and a small cluster of trading wallets are involved. In this case, heavy token trading reflected the reported movement of stolen funds—not demonstrated adoption or project quality.