North Korea Is Minting Its Own Meme Coins to Move Binance Hack Money: 117,000 NEAR Passed Through Six Throwaway Tokens, Elliptic Says

How the trick works

Elliptic describes four steps. The launderers create a new token with one of the public token-launch tools on a chain. They open a liquidity pool on a decentralized exchange that pairs the token with a real asset, such as NEAR or a stablecoin. One set of wallets pays stolen funds into the pool and receives the new token. A second set of wallets sells the token back into the same pool and withdraws the real asset.

The stolen money never moves straight from a buying wallet to a collecting wallet, because the pool sits in between. Seen from outside, the collecting wallets look like traders who sold a meme coin at a profit.

Elliptic says it first saw this in the laundering of the 2025 Bybit theft, which, like the October 2026 Binance heist, was attributed to the North Korean group TraderTraitor. In that case a worthless Tron token paired with a stablecoin moved at least $24 million.

The six NEAR tokens

Source: Elliptic. SGT times are our conversion.

Each token cost about 25 NEAR, around $90, to create. The logos copy ordinary meme coin style: a monkey with a pink bow, a duck in front of a US flag, a chimpanzee, a fox, a flaming gold badge and an image of Elon Musk under an "Elon 2028 President" banner. Elliptic notes there is no suggestion Musk has any connection to the tokens.

Elliptic lists three signs that the tokens existed only to launder:

• Wallets in the laundering network made every sale of all six tokens and bought every unit of five of them. Outside buyers made a handful of small FUK purchases on its first day, under 1% of its volume. DABI, MMLI and SINU each had one buying wallet and one selling wallet.
• Five of the six token creators were funded by a wallet that had been selling an earlier token 2 to 13 minutes before the new launch. The proceeds of one token paid for the next.
• Each token was first sold within three hours of launch and did at least three quarters of its trading within one day. The stolen NEAR that went in matched the NEAR that came out.

On the afternoon of November 8, the creators of four of the tokens pulled the liquidity left in their pools. Most of the NEAR that left the collecting wallets went into stablecoins or to a cross-chain bridge, Elliptic says.

Tron and Solana too

The NEAR tokens are the clearest example, not the only one. Elliptic says it identified a worthless Tron token created solely to launder Binance funds on November 2. A day later, stolen SOL was swapped into wrapped, thinly traded tokens on Solana, sold for USDC and moved to other chains. Those Solana tokens already existed; the aim was the same, to put an obscure asset between the stolen money and the next wallet.

Odaily and PANews carried the same figures on Monday evening. Both cite Elliptic, so they confirm what Elliptic published rather than add an independent count.

Why it slows tracing rather than hiding anything

Every step is on a public blockchain. Elliptic's own view is that the technique "slows investigators down rather than hiding the funds". Each extra hop takes time to unpick, and laundering is a race to move money before addresses are flagged. At about $90 a token, the launderers can make many of them and throw each away after one use. Elliptic describes the tokens as one more cheap layer on top of others.

That matches the wider picture we have reported over the past week: swaps through THORChain, XRP converted mostly into bitcoin, and now home-made tokens. None of these routes erases the trail, and each one costs the launderers time.

What the 11.8 million unmoved NEAR means for NEAR traders

Elliptic counts about 11.8 million NEAR from the theft that has not yet moved. It values that at $43.7 million. At 00:50 SGT on November 10, NEAR traded at $3.596 on Binance's public market data, down 1.67% over 24 hours, and at $3.597 on OKX and $3.594 on Bitget. At the Binance price, the stash is worth about $42.4 million (11.8 million × $3.596, our arithmetic).

For scale: Binance's NEARUSDT spot market traded 27.26 million NEAR in the 24 hours to that reading. The unmoved stash equals about 43% of one day of that single market's volume (11.8 ÷ 27.26). We are not saying it will be sold, or sold on any exchange. Elliptic gives no forecast. But it is a known quantity of stolen coins whose owners have shown they want to turn NEAR into stablecoins.

Perpetual funding does not show a crowded bet either way. The current NEAR-USDT funding rate was 0.0075% per 8 hours on Bitget and 0.0084% on OKX at the same time, close to neutral. You can compare it with other coins on our funding-rates page.

What to check if you trade meme coins or receive swap proceeds

Elliptic wrote its warning signs for compliance teams. They also work as a checklist for anyone buying a brand-new token:

• The token was created in the last few days.
• Only a handful of wallets trade in its pool.
• Some wallets only buy and others only sell.
• New wallets were funded shortly before they started trading, often in round amounts.

A token that fits all four is not a trading opportunity. Its price is whatever its creators set, and the liquidity can vanish, as it did in four of the six NEAR pools on November 8.

The second point matters if you move funds from a decentralized exchange to a centralized one. Elliptic tells firms to ask "what went into the pool, not just who paid out", to screen against its public Binance hack blocklist, and to re-check deposits they have already accepted as that list grows. Our reading: a deposit that comes from swap proceeds touching a flagged pool can be held for review even after it has been credited. If you trade on decentralized exchanges, keep a record of what you swapped and when.

One more check, and it applies to everyone following this story. Treat any message offering "Binance compensation" for the hack as suspect. Confirm account actions only through Binance's own app and website, and do not open payout links sent by direct message. Our Binance profile collects the official pages.

What we could not confirm

• Whether any exchange has frozen funds that passed through the six NEAR tokens. Elliptic does not say.
• Which cross-chain bridge received the NEAR after the swaps. Elliptic names no bridge.
• CoinDesk's and The Block's pages on the report blocked our reader this run, so we relied on Elliptic directly.
• How much of the $6.4 billion has passed through home-made tokens on Tron. Elliptic gives a figure only for NEAR.

Quick answers

How much stolen money went through the meme coins?

About 117,000 NEAR, around $430,000 at Elliptic's prices, passed through six tokens on NEAR between November 5 and 7.

Are these meme coins still trading?

No. Elliptic says none of the six has traded since November 8, and the creators of four of them withdrew the remaining pool liquidity that afternoon.

Does this hide the stolen funds?

No. Every step is visible on-chain. Elliptic says the method slows investigators down, and each token is cheap enough to discard.

How much stolen NEAR has not moved?

About 11.8 million NEAR, which Elliptic values at $43.7 million. At Binance's $3.596 price at 00:50 SGT on November 10, that is about $42.4 million.