North Korea-Linked Crypto Laundering Routes Binance Hack Funds Through Worthless Meme Coin Pools

Launderers linked to North Korea, which denies the attribution, moved stolen Binance funds through six throwaway NEAR tokens that were each sold within three hours of launch and then abandoned, blockchain analytics firm Elliptic reported Nov. 9. Because the only connection between the thief wallets and the payout wallets is the liquidity pool itself, address blocklists alone cannot flag the payouts, so exchanges, bridges and stablecoin issuers have to trace what funded each pool.

Liquidity Pool Is Only Link Between Thief Wallets and Payouts

The technique has four steps. A launderer creates a token, pairs it with a real asset such as NEAR or a stablecoin in a decentralized exchange pool, has buyer wallets pay in stolen funds, and has separate seller wallets sell the token back out for the real asset. TRM Labs described the same pattern on TRON, finding no transfer between the buyer wallets and the seller wallet. The pool is the only link between them.

Pools of this kind generally price their two assets with a constant-product rule, where the quantities of the two assets multiplied together stay constant (x×y=k), so every buy automatically pays out from the pool's reserves. Elliptic did not name the NEAR exchange or describe its pool design, and said the exchange, the token-launch tool and a popular wallet app did nothing wrong.

Each token cost about 25 NEAR (about $90) to create. That is a trivial expense against the roughly 117,000 NEAR (about $430,000) that passed through the six tokens.

Six NEAR Tokens, Each Sold Within Three Hours of Launch

Elliptic named the tokens FUK, OLCCL, MEILI, MMLI, DABI and SINU. FUK was created at 7:25 p.m. ET on Nov. 4, and SINU at 5:06 a.m. ET on Nov. 7, about 58 hours later. At least three-quarters of each token's trading happened in a single day.

The wallets behind the laundering made every sale of all six tokens and bought every unit of five of them. DABI, MMLI and SINU each had exactly one buyer and one seller. Outside purchases of FUK stayed under 1% of its volume.

Five of the six token creators received funding two to 13 minutes after a wallet sold an earlier token, which ties each launch to the proceeds of the last. Four creators withdrew their liquidity on the afternoon of Nov. 8.

TRM Labs Found Same Technique on TRON; Bybit Used It in 2025

The NEAR tokens are not an isolated experiment. TRM Labs documented a self-minted token on TRON that only its creator could mint, created Oct. 31, with a free mint of 300 million tokens on Nov. 1. TRM also described a lending-protocol receipt token used as a pass-through and chained bridges used to hop between networks. By matching amounts and timing, TRM placed 11 of 38 orders, worth about $290,000, as payouts on Ethereum, an inference rather than a confirmed link.

Elliptic identified a worthless token on Tron on Nov. 2 that it said was created solely to launder funds, similar to those used in the Bybit case. The next day, stolen SOL was swapped into existing, wrapped, thinly traded tokens on Solana and sold for USDC, a close variant using tokens the launderers did not create.

The playbook has a precedent. After the February 2025 Bybit theft, launderers used a worthless Tron token and a jUSDT pool on SunSwap to move at least $24 million.

Pyongyang Calls FBI Attribution Absurd as Elliptic and TRM Trace Funds

The FBI said Oct. 31 that a North Korean cyber operation it calls TraderTraitor carried out the Binance theft and that the hackers were converting proceeds to Ethereum. On Nov. 3, Kim Yo Jong, a senior North Korean official, denied the accusation through the state news agency KCNA and called it "absurd rhetoric," according to Reuters via Devdiscourse.

Elliptic's broader laundering count shows the scale of the effort: about $6.43 billion stolen, more than 20,000 wallets, 16 blockchains, at least 36 services and at least 65,000 transactions.

Freezes reached further than after Bybit. About $2.85 billion, or 44%, was frozen or seized, against roughly 3% after Bybit, yet about $3.0 billion remained in theft-linked addresses.

THORChain Declines to Commit While NEAR Intents Screens Flows

The FBI's alert lists 628 addresses: 608 on Ethereum, 19 on Bitcoin and one on Solana. It asks THORChain node operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to refuse transactions with or derived from those addresses. THORChain has not committed to act on the request. Co-founder Chad Barraford wrote on X that node operators have no information that is not already public, and co-founder JP Thor wrote that taking the protocol offline would end the experiment.

Georgia Institute of Technology academic Jenny Jun, who studies North Korean hacking, said the main challenge lies in turning detection into action.

None of the 628 addresses appears on the Treasury Department's sanctions list, according to American Banker's review. The Office of Foreign Assets Control (OFAC) prohibits exporting financial services to North Korea, but Elliptic noted TraderTraitor is not specifically designated. Brian Laverdure, a senior vice president at the Independent Community Bankers of America, said community banks should not be expected to serve as a cleanup crew for regulatory gaps elsewhere. Jon Glass, a partner at consulting firm SolomonEdwards, said banks often need information from the exchange to trace where funds originated, and that tracing a payment to the theft does not automatically create a duty to freeze funds, though it may require a suspicious activity report.

NEAR Intents, a separate NEAR product that is not the exchange pools in Elliptic's report, took a different approach in the Bitget case. Its SHIELD screening blocked more than $50 million of Bitget-linked flows, froze $503,000 and let about $166,000 pass, and general manager Alex Shevchenko defended the system.

Can Exchanges Still Trace Funds Paid Out From Liquidity Pools?

Yes, but more slowly. Elliptic's assessment is that the method slows the people tracing the funds rather than hiding them. Its guidance to compliance teams is not to treat pool payouts as clean by default, to ask what went into the pool and not just who paid out, and to watch for tokens created in the last few days, pools with few traders, wallets that only buy or only sell, and new wallets funded shortly before trading. Elliptic also offers a free blocklist of nearly 18,000 addresses linked to the theft.

Roughly 11.8 Million NEAR Still Sits Unmoved

About 11.8 million NEAR (about $43.7 million) had not moved as of Elliptic's report. Elliptic expects the attacker to eventually cash out through over-the-counter brokers and exchanges over months, a step that needs a counterparty.

For compliance teams, the decision is concrete: an address list catches transfers, but a pool payout carries no transfer to catch. Teams that screen only addresses will miss it, and teams that trace pool funding can still follow it.

Dollar figures in this article are Elliptic's valuations as of Nov. 9, 2026, and are approximate; NEAR prices move quickly.

Frequently Asked Questions

Can address blocklists catch laundering through liquidity pools?

Not by themselves. The only link between the thief wallets and the payout wallets is the pool, so a blocklist of thief addresses does not match the payout. Screening what funded the pool is the step Elliptic's compliance guidance points to.

How does a worthless token launder money?

Launderers create a token, pair it with a real asset in a pool, buy it with stolen funds from one set of wallets and sell it from another set. The seller wallets receive clean-looking proceeds from the pool, not from the thief.

Does North Korea admit hacking Binance?

No. Kim Yo Jong denied the accusation on Nov. 3 through KCNA. The FBI attributes the theft to North Korea, and Elliptic and TRM Labs describe the laundering as North Korea-linked.

Did the NEAR laundering involve NEAR Intents?

Elliptic did not name the NEAR exchange used, and NEAR Intents is a separate product. The report does not say it was involved or bypassed.