Elliptic: Binance Hackers Pushed Stolen NEAR Through Six Throwaway Tokens

By Coinvote

Published November 9, 2026 - 19:21 UTC | 5 mins read

Elliptic: Binance Hackers Pushed Stolen NEAR Through Six Throwaway Tokens

Elliptic traced about $430,000 of stolen NEAR through six disposable meme tokens that North Korea-linked launderers created after the Binance theft. The tactic is cheap, leaves a public trail, and adds steps that slow investigators.

Six disposable tokens carried stolen NEAR

Blockchain analytics firm Elliptic said on Monday that launderers tied to the Binance theft created at least six meme tokens on the NEAR blockchain. According to Bitcoin Magazine, about 117,000 NEAR, or roughly $430,000, passed through them. CoinDesk reported the same totals and described the tokens as homemade.

The Block framed the story around tokens themed on Elon Musk and animals, and relayed Elliptic's view that the extra swaps slow investigators while the funds stay traceable onchain. Protos added that the animals include ducks and chimpanzees, and that one token promotes Musk as a future president in 2028. Bitcoin Magazine named the six tokens as FUK, OLCCL, MEILI, MMLI, DABI and SINU, minted between Nov. 5 and 7.

The four-step hop that breaks the direct link

Bitcoin Magazine laid out the mechanics from Elliptic's findings. First, the launderers mint a new token using a publicly available launcher. Next, they set up a liquidity pool that matches the token against an established asset, for example NEAR or a stablecoin. One set of wallets buys the new token with stolen funds, and a second set sells it back into the same pool and collects the real asset.

Because the pool sits between the two sets of wallets, the funds never move straight from one to the other. To someone glancing at the chain, the receiving wallets resemble regular traders cashing out a profitable sale. Elliptic co-founder Tom Robinson summed it up this way: "North Korea's launderers have found a different use for them."

Key figures from the Elliptic findings

The amounts moved through the tokens are small next to the size of the theft. The details around them show how the scheme was run.

Each token cost about 25 NEAR, or around $90, to create, according to Bitcoin Magazine.
Elliptic found that a wallet which had just sold an earlier token paid for the creation of five of the six tokens, with the funding arriving two to 13 minutes ahead of each launch.
None of the six has traded since Nov. 8, and the creators of four withdrew the remaining liquidity that afternoon.
Protos reported that the TraderTraitor wallet that funded the tokens held around $43.7 million worth of NEAR.
Bitcoin Magazine put the NEAR that has not moved at about 11.8 million, worth $43.7 million, and said roughly 3,000 BTC, about $225 million, sits in new bitcoin addresses.

How the outlets' accounts compare

The outlets agree on the core finding, the $430,000 figure and Elliptic as the source. They differ on the size of the theft. Protos wrote $6.4 billion, CoinDesk wrote $6.3 billion, and Bitcoin Magazine said Binance itself put the loss at $6.34 billion, which explains the gap as rounding.

They also differ on emphasis. Protos stressed Elliptic's reasons for calling the activity laundering: nobody else traded the tokens, they were paid for with proceeds from an earlier linked launch, and they were used briefly and then dropped. It also reported that the profit on sale was roughly equal to the money put in. Bitcoin Magazine alone gave the launch dates, the token names and the timing between wallet transfers.

On other chains, Protos said stolen funds were traced to one TRON token and one Solana token. Bitcoin Magazine gave more detail, describing a similar approach on Solana that relied on tokens already in existence and lightly traded, not newly created ones. CoinDesk and The Block were available only as headlines and summaries, so their coverage supports the headline claims and nothing more.

Why a $90 token is useful to launderers

Elliptic does not claim the tokens hide anything. As Bitcoin Magazine put it, every step is public on-chain, and what the tactic buys is time. Each extra hop forces investigators to follow more transactions while the launderers try to move funds before they are flagged. At about $90 per launch, the tokens are cheap enough to discard.

Protos said Elliptic did not identify the launch tool or the decentralised exchange involved, and noted that these services "did nothing wrong". Elliptic's position, as Protos relayed it, is that the launderers used them like any other user. For readers who follow the meme coin market or new Solana listings, the practical point is limited. Elliptic's markers were thin trading, funding from a prior token's sale proceeds and a very short life, and those can be checked on-chain.

A pattern repeated from the Bybit case

Protos and Bitcoin Magazine both said Elliptic saw TraderTraitor use the same method after the February 2025 Bybit theft. In that case a worthless TRON token helped move at least $24 million. Protos put the Bybit loss at $1.5 billion, while Bitcoin Magazine cited $1.46 billion.

Bitcoin Magazine said the FBI attributed the Oct. 29 Binance theft to TraderTraitor. It added that Elliptic's tracking of the wider laundering effort spans over 20,000 wallets across 16 blockchains, along with 36 or more services and 65,000 or more transactions. About $2.85 billion of the stolen haul has been frozen, according to Bitcoin Magazine, which also relayed Elliptic's assessment that very little of the money has probably been converted to cash so far.

What to watch next

The main open question is whether this tactic spreads faster than blocklists and exchange compliance teams can respond. Bitcoin Magazine framed it as a race between the launderers' homemade pools and the tools used to flag them.

Other points to follow are whether the launch tool and exchange involved add controls, and how much of the 11.8 million NEAR that has not moved eventually enters similar token pools. Elliptic's next update on the bitcoin addresses will show whether the conversion route changes.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$74,618	-1.6%	-3.2%	$1.50 trillion
Ethereum (ETH)	$2,122	-4.9%	-5.9%	$259.32 billion
XRP (XRP)	$1.09	-5.2%	-12.2%	$69.46 billion
TRON (TRX)	$0.316724	-1.0%	-0.3%	$30.10 billion
NEAR Protocol (NEAR)	$3.62	-0.9%	-7.8%	$4.74 billion

CoinGecko data as of 2026-11-09 (UTC); DeFi TVL from DefiLlama: Solana $5.09 billion, Tron $4.95 billion.

On Coinvote

Best Meme Coins Today: Top Memecoins: 3,768 projects tracked, 52 new listings in 7 days, 254 community votes today.
New Meme Coins Launched Today: 3,768 projects tracked, 52 new listings in 7 days, 254 community votes today.
New Solana Tokens Listed Today: 3,817 projects tracked, 52 new listings in 7 days, 486 community votes today.
Best Solana Meme Coins Today: 2,482 projects tracked, 26 new listings in 7 days, 151 community votes today.

FAQ

How did North Korea-linked hackers use meme coins to launder Binance funds?

According to Elliptic, as reported by Bitcoin Magazine, the launderers created tokens, paired each with NEAR in a liquidity pool, and used one group of wallets to buy them with stolen money. A second set of wallets sold the tokens back into the pool, so no direct transfer linked the two sets.

How much stolen money went through the six NEAR tokens?

Bitcoin Magazine and CoinDesk both reported about 117,000 NEAR, worth roughly $430,000, passed through six tokens. That is small compared with the Binance theft of around $6.3 billion.

Does the meme coin method make the funds untraceable?

No. The Block reported Elliptic's view that the extra swaps slow investigators but the funds remain traceable onchain. Bitcoin Magazine also said every step is public and that the method mainly buys time.