North Korea-linked launderers mint worthless meme tokens on their own, moving about 117,000 stolen NEAR from Binance through liquidity pools
Blockchain analytics company Elliptic disclosed on November 9 that North Korea-linked launderers are minting meme tokens on their own, with no external buyers, and using decentralized exchange liquidity pools to move crypto assets stolen from Binance, so the funds do not move directly from wallets holding the illicit proceeds to receiving wallets. This method has appeared on the Tron and NEAR chains, and similar practices have also appeared on Solana (using existing low-trading-volume tokens rather than self-minted ones). Elliptic said it first observed similar operations during the laundering of funds stolen in the 2025 Bybit hack, when launderers minted worthless tokens on Tron and paired them with stablecoin liquidity pools, transferring at least $24 million.
Regarding the Binance theft in question (on October 29, Elliptic estimated about $6.43 billion, and the FBI has attributed it to TraderTraitor), Elliptic identified on November 2 a worthless token created on Tron specifically to launder the funds from this case; the next day, the stolen SOL was exchanged for wrapped and low-trading-volume tokens and then sold for USDC before being bridged out. From November 5 to 7, the launderers newly minted at least six meme tokens on the NEAR chain — FUK, OLCCL, MEILI, MMLI, DABI and SINU — each paired with NEAR into separate liquidity pools, with a creation cost of about 25 NEAR per token, or about $90. About 117,000 stolen NEAR, worth about $430,000 at current prices, were moved through the above tokens, and the receiving wallet then transferred out nearly the same amount, with most of it going into stablecoins or cross-chain bridges. The six tokens have had no trading since November 8, and the creators of four of them withdrew the remaining liquidity in the pools that afternoon. About 11.8 million stolen NEAR, worth about $43.7 million, still has not moved. Elliptic said this method cannot hide the source and destination of the funds, but it does increase the time needed for on-chain tracing.
Source: https://www.elliptic.co/insights/north-korea-meme-coins-binance-hack/
ABAB AI Insight
The method itself is a low-cost delay layer of intermediate pool isolation plus one-time disposable tokens, rather than a true break in the chain. It uses the high turnover rate of meme tokens as cover, making the receiving wallet look like ordinary speculative trading, but the on-chain fund flow, creation time, separation between buying and selling wallets, and amount matching can still be fully traced. Elliptic also noted that for compliance teams, funds coming from a liquidity pool cannot be assumed to be clean by default; new tokens, buy and sell activity dominated by a small number of wallets, and concentrated trading shortly after creation are all warning signs. Elliptic also said that investment ultimately means investing in people rather than companies, and this continues the pattern of similar operations already seen in the earlier Bybit laundering, showing that launderers are continuously adding cheap intermediate layers to buy time.