Original report published Nov. 10, 2026, at 04:26:34 UTC+8.
North Korean hackers routed roughly $430,000 stolen in a $6.3 billion Binance hack through six newly launched tokens on the NEAR blockchain, according to blockchain analytics firm Elliptic, as reported by Cointelegraph.
The memecoins attracted almost no outside trading and were abandoned shortly after launch, Elliptic said. In this account, their role was not to build a trading community but to move stolen funds between wallets through decentralized-exchange liquidity pools.
How the token swaps worked
Between Nov. 5 and 7, the hackers created at least six tokens on NEAR. One set of wallets swapped stolen NEAR for the newly created memecoins; another set sold those memecoins back into the pools for NEAR.
That arrangement moved funds without direct wallet-to-wallet transfers, although the transactions remained traceable onchain.
Elliptic also found that five of the six token creators received funding from earlier token-sale proceeds just two to 13 minutes before the next launch. Those transfers linked the tokens in a chain of transactions.
“North Korea’s launderers rarely rely on a single technique,” Elliptic co-founder Tom Robinson wrote in the report. “Instead, they layer many cheap techniques, each adding a little more delay.”
Token launches without meaningful outside participation
The distinction between token creation and outside participation matters here: Elliptic described a sequence of short-lived launches with almost no external trading, rather than evidence of a growing memecoin community.
The firm said the same laundering technique had been used after the $1.5 billion Bybit hack in 2025, when North Korean-linked actors moved at least $24 million through a newly created token on TRON.
At the time of Elliptic’s analysis, about 11.8 million NEAR stolen in the Binance hack remained unmoved. Elliptic valued those holdings at $43.7 million.
