Meme coins can serve as more than speculative assets: according to blockchain analytics firm Elliptic, North Korean hackers used tokens they created themselves to route part of the reported $6.4 billion stolen from Binance through decentralized-exchange liquidity pools.
Decrypt’s original report, published on November 10, 2026, at 03:36:02 UTC+8, described a scheme that made receiving wallets resemble ordinary meme-coin traders. Elliptic stressed that the transactions remained traceable onchain—the technique complicated investigations rather than erasing the trail.
Meme branding, not evidence of adoption
Elliptic’s research, credited to co-founder Tom Robinson, identified the tactic on Tron and Near, with a closely related approach on Solana.
The clearest example involved at least six tokens created on Near between November 5 and 7. Their imagery borrowed familiar meme-coin conventions: a bow-wearing monkey, a flag-draped duck, a chimpanzee and a fox. One used an “Elon 2028 President” image of Elon Musk, who had no connection to the tokens. Names included FUK and SINU.
Each token reportedly cost about 25 NEAR, roughly $90, to create. All six were paired with NEAR in separate liquidity pools, traded heavily within hours using stolen NEAR, and were then abandoned. The remaining liquidity was withdrawn on November 8.
For this group of tokens, trading activity was evidence of the reported laundering operation—not evidence of an organically growing community or use case.
How the pools interrupted direct wallet links
According to Elliptic, the launderers created tokens with no underlying value and paired them with assets such as NEAR or stablecoins. One set of wallets used stolen funds to buy the tokens through a pool; another set sold the tokens into the pool and collected the proceeds.
The pool acted as an intermediary, so stolen assets did not move directly from the buying wallet to the collecting wallet. The recipients could therefore look like traders cashing out a meme coin, even though the transaction history remained visible.
About 117,000 NEAR, or roughly $430,000, passed through the six Near tokens. Much of that subsequently moved into stablecoins or a cross-chain bridge.
A delaying tactic, not an erased trail
Those amounts represented only a small portion of the reported theft. Elliptic had previously found that more than $3 billion in stolen crypto had yet to be laundered, while the launderers were creating a new wallet roughly every 25 seconds.
The firm said it first observed the meme-token tactic the previous year while investigating the $1.5 billion Bybit theft, which was also attributed to TraderTraitor, the group identified as responsible for the Binance breach.
Elliptic’s warning for compliance teams was that a liquidity pool is not proof of clean funds. Newly minted tokens and activity concentrated among a small number of wallets warrant scrutiny. In this case, disposable meme coins added a cheap layer of complexity, buying time before funds could be flagged rather than making them untraceable.
