The blockchain firm traced stolen funds through six new tokens on NEAR, where hackers used liquidity pools to obscure transfers between wallets.

North Korean hackers created memecoins to launder cryptocurrency stolen in the $6.3 billion Binance hack, routing roughly $430,000 through six newly launched tokens on the NEAR blockchain, according to a report from blockchain analytics firm Elliptic.

Between Nov. 5 and 7, the hackers created at least six tokens on NEAR and used liquidity pools on decentralized exchanges to move stolen funds between wallets, Elliptic said. The tokens attracted almost no outside trading and were abandoned shortly after launch.

The hackers used one set of wallets to swap stolen NEAR tokens for the new memecoins, then used another set to sell those memecoins back into the pools for NEAR. The swaps let them move funds without direct wallet-to-wallet transfers, though the transactions remained traceable onchain.

Elliptic also found that five of the six token creators were funded with proceeds from earlier token sales just two to 13 minutes before the next launch, linking the tokens in a chain of transactions.

“North Korea’s launderers rarely rely on a single technique,” Elliptic co-founder Tom Robinson wrote in the report. “Instead, they layer many cheap techniques, each adding a little more delay.”

Elliptic said the same laundering technique was also used following the $1.5 billion Bybit hack in 2025, when North Korean-linked actors moved at least $24 million through a newly created token on the TRON blockchain.

Source link