Elliptic analysts have uncovered a new scheme for laundering crypto assets stolen from Binance.

The perpetrators created their own memecoins and used liquidity pools to move funds.

About $430,000 passed through six tokens on the NEAR network.

Hackers linked to North Korea have begun using specially created memecoins to launder crypto assets stolen in a large-scale breach of Binance. This was reported by Elliptic analysts.

According to the experts, the perpetrators used this scheme on the TRON and NEAR networks, and also used a similar mechanism on Solana. Its purpose was to complicate the tracking of transactions through intermediate operations with little-known tokens.

How the scheme worked

The hackers created memecoins with no real value and opened liquidity pools for them on decentralized exchanges. Then some controlled wallets bought these assets with the stolen funds, while others sold them through the same pools, receiving liquid cryptocurrencies.

Thus, there were no direct transfers between the wallets with the stolen assets and the final recipients. The latter could look like ordinary traders who made a profit from selling the tokens.

From November 5 to 7, 2026, the perpetrators created at least six memecoins on the NEAR network — FUK, OLCCL, MEILI, MMLI, DABI, and SINU. The cost of launching each was about 25 NEAR, or $90.

Approximately 117,000 NEAR worth about $430,000 passed through these assets. Most of the operations were conducted during the first day after launch, after which trading stopped.

The analysts established that almost all transactions were carried out by interconnected addresses. At the same time, the proceeds from the sale of some tokens were used to create the next ones.

As of the time of the study, about 11.8 million NEAR worth $43.7 million from the stolen assets remained unmoved.

Elliptic emphasized that such a scheme does not provide complete anonymity. All operations are stored on the blockchain and can be traced, but the additional transactions slow down the work of analysts.

The experts also recalled that a similar mechanism was used after the Bybit breach in 2025. At that time, through a specially created token on the Tron network, the perpetrators moved at least $24 million.

What is known about the Binance breach

What is known about the Binance hack

Recall that on October 29, 2026, Binance suffered the largest hacker attack in the history of the crypto industry. The perpetrators withdrew about $6.3 billion across ten blockchains. A detailed chronology of the incident was analyzed earlier.

The US Federal Bureau of Investigation attributed responsibility for the attack to the North Korea-linked TraderTraitor group. At the same time, North Korean authorities rejected the accusations.

After the incident, the hackers began actively moving the stolen funds. In particular, within two days they laundered about $242 million through Tron and cross-chain protocols.

Later, Binance co-CEO Richard Teng stated that the exchange had recovered 98% of the affected assets and strengthened its security systems.