This article is an automated aggregation of coverage from news outlets. Our editorials offer in-depth analysis curated by the NewsCord team.
North Korean launderers minted at least six NEAR-based memecoins to move Binance hack funds. The scheme used liquidity pools to obscure transfers, preventing direct wallet-to-wallet movement.
11 outlets in this story. Read their headlines below.
Meme coins route Binance loot
Blockchain analytics firm Elliptic said North Korean launderers created worthless meme coins and used them to move stolen Binance funds through liquidity pools so the funds never transferred directly from one wallet to another.
North Korean launderers minted at least six new tokens on the NEAR blockchain between Nov. 5 and 7, naming FUK, OLCCL, MEILI, MMLI, DABI and SINU.
About 117,000 NEAR, or roughly $430,000, passed through the six tokens, and the trail sits inside the broader laundering of the Oct. 29 Binance theft that Binance put at $6.34 billion.
Elliptic said its wider update put roughly 3,000 BTC, about $225 million, in new bitcoin addresses converted from other stolen assets, while about 11.8 million NEAR, or $43.7 million, from the theft had still not moved.
Elliptic co-founder and chief scientist Dr. Tom Robinson wrote, "Most people think of meme tokens as joke coins whose prices rise and fall on hype," and he added that "North Korea’s launderers have found a different use for them."
How the liquidity pool works
Elliptic described a four-step hop in which launderers create a token with a public launch tool, open a liquidity pool pairing it with a real asset such as NEAR or a stablecoin, buy the new token with stolen funds, and then sell it back out through a second set of wallets. The pool sits in between so "At no point do the stolen funds transfer directly from a buying wallet to a collecting wallet" and the collecting wallets can look like ordinary traders who sold a token at a profit. Elliptic said the six NEAR tokens cost about 25 NEAR, or around $90, to create, and it said each was traded heavily within hours using stolen NEAR before being abandoned.
Elliptic said five of the six token creators were funded by a wallet that had just sold an earlier token between two and 13 minutes before the next launch, linking the tokens in a chain of transactions. The technique does not hide the funds because "Every step is public on-chain," and the approach buys time by slowing investigators while launderers race to move funds before they are flagged.
What compliance teams face next
Compliance teams should not treat funds arriving from a liquidity pool as clean by default, particularly where newly created tokens are involved. The launderers used the same general approach on Tron and NEAR and a close variant on Solana, and it said it had first reported the technique in the laundering of funds stolen from Bybit in 2025. About 11.8 million NEAR, worth $43.7 million, stolen in the Binance hack remained unmoved at the time of its analysis, and the technique could carry far larger sums because it is cheap to run.
Elliptic co-founder Tom Robinson wrote that "North Korea’s launderers rarely rely on a single technique," and he said they "layer many cheap techniques, each adding a little more delay." The test for investigators is whether homemade liquidity pools keep multiplying faster than blocklists catch up, and the trail can still be followed on-chain even as the method slows tracing.
