Elliptic Traces Binance Hack Funds Through Homemade Memecoins
North Korea-linked launderers moved about $430,000 in stolen NEAR through six homemade tokens, Elliptic says, complicating rather than erasing the trail.
Key Notes
- Elliptic traced about 117,000 stolen NEAR through six newly created memecoins.
- The firm identified related activity on Tron and Solana and previously documented the approach after the Bybit hack.
- The transactions complicate tracing but do not erase the public blockchain trail.
North Korea-linked money launderers are creating disposable memecoins to move proceeds from the Binance hack, according to Elliptic. The blockchain analytics firm traced about 117,000 NEAR, worth roughly $430,000 at its report’s valuation, through six newly created tokens between November 5 and 7.
The findings in Elliptic’s November 9 laundering investigation describe a small, identifiable portion of the multibillion-dollar theft. They do not establish that the entire stolen balance has passed through memecoins or been converted into cash.
Trading Creates an Indirect Route
Instead of sending assets directly between wallets, the operation used decentralized-exchange liquidity pools pairing newly issued tokens with NEAR. Some wallets bought the tokens using stolen funds, while others sold tokens into the pools and received NEAR.
The receiving wallets could consequently appear to have earned trading proceeds. The pool stood between the two groups, adding transactions for investigators to untangle without removing their public record.
Six Tokens Were Quickly Abandoned
Elliptic estimates that creating each token cost about 25 NEAR, or $90. It says the tokens were traded shortly after launch and then discarded, with no further trading observed after November 8.
The firm’s evidence includes closely matched inflows and outflows and almost no outside participation. Wallets in the laundering network accounted for every sale across the six tokens. Outside purchases represented less than 1% of trading in the one token that attracted them.
Elliptic also identified a similar purpose-built token on Tron. On Solana, it observed stolen SOL passing through existing, thinly traded tokens before conversion into USDC and movement across chains. Those Solana tokens were not newly created by the launderers.
The firm previously documented the approach following the 2025 Bybit hack, when at least $24 million moved through a token on Tron.
The Theft and the Recovery Are Separate Questions
The Binance theft occurred on October 29. In an October 31 cyber alert, the FBI attributed it to North Korea’s TraderTraitor operation. The bureau said it and federal partners had observed conversions primarily into ether and anticipated further laundering through decentralized finance and instant-swap services.
North Korea has denied responsibility, as covered in CoinScreamer’s denial report. Binance’s later account described compromised employee devices and access to wallet-signing systems, detailed in our attack timeline.
Public transaction records can reveal where value travels, but identifying a route does not give investigators control of the receiving assets. A token freeze, a seizure and the return of funds to a victim are separate events, as our recovery explainer examines.
Elliptic’s assessment is that the memecoin transactions buy time rather than anonymity. For investigators, the relevant connection remains the origin of the assets entering a pool, even when the next wallet receives what looks like ordinary trading revenue.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
