Elliptic analysts said North Korea-linked hackers used purpose-built memecoins from Nov. 5 to 7, 2026, to launder cryptoassets stolen in the Oct. 29 Binance hack. The scheme routed about $430,000 through six tokens on the NEAR network, adding intermediate transactions intended to make the funds harder to trace.

The attackers used the scheme on the TRON and NEAR networks and deployed a similar mechanism on Solana, Elliptic reported. The transactions involved little-known tokens and were designed to obscure the movement of the stolen assets.

How the scheme worked

According to Elliptic, the hackers created memecoins with no real value and opened liquidity pools for them on decentralized exchanges. Some wallets under their control used stolen funds to buy the tokens, while other controlled wallets sold the same assets through the pools and received liquid cryptocurrencies.

The arrangement avoided direct transfers between wallets holding stolen assets and the eventual recipients. Those recipients could instead appear to be ordinary traders who had profited by selling the tokens.

From Nov. 5 to 7, the attackers created at least six memecoins on NEAR: FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each token cost about 25 NEAR, or $90, to launch.

Approximately 117,000 NEAR, worth about $430,000, flowed through the six assets. Most transactions occurred within the first 24 hours after each launch, after which trading stopped.

Elliptic found that virtually all trades were conducted by addresses linked to one another. The proceeds from selling one token were then used to create the next.

At the time of Elliptic’s study, about 11.8 million NEAR, worth $43.7 million, in stolen assets remained unmoved.

Elliptic said the method does not provide complete anonymity because every operation remains recorded on the blockchain and can be traced. However, the additional transactions can slow analysts attempting to follow the funds.

The firm also said attackers used a similar mechanism after the 2025 Bybit hack, moving at least $24 million through a specially created token on the TRON network.

The Binance hack

Binance suffered what the source described as the largest hack in cryptocurrency industry history on Oct. 29, 2026. The attackers siphoned off about $6.3 billion across 10 blockchains.

The U.S. Federal Bureau of Investigation attributed the attack to the North Korea-linked TraderTraitor group. North Korean authorities rejected the allegation.

After the incident, the hackers began moving the stolen funds and laundered about $242 million over two days through Tron and cross-chain protocols.

Binance co-CEO Richard Teng later said the exchange had recovered 98% of the affected assets and strengthened its security systems.

Source: Incrypted