North Korean hackers have launched new memecoins on the NEAR blockchain to launder digital assets stolen in the $6.3 billion Binance hack, according to blockchain analytics firm Elliptic. The actors routed approximately $430,000 through six newly created tokens.
Between November 5 and 7, the hackers generated at least six tokens and utilized decentralized exchange liquidity pools to transfer stolen assets between wallets without direct wallet-to-wallet transactions. These tokens gained virtually no external trading volume and were quickly abandoned. Elliptic noted that five of the token creators received funding from previous token sales minutes before launching new ones, creating a connected chain of transactions. Approximately 11.8 million NEAR, valued at $43.7 million from the Binance hack, remained unmoved at the time of the analysis.
Tom Robinson, co-founder of Elliptic, stated that North Korean launderers utilize multiple layered techniques to add delays rather than depending on a single method. A similar laundering strategy was previously observed following the $1.5 billion Bybit hack in 2025, where actors moved at least $24 million via a new token on the TRON blockchain.
For crypto readers, these findings highlight evolving onchain obfuscation tactics used by bad actors, demonstrating how decentralized liquidity pools and short-lived tokens can be weaponized to obscure the movement of stolen funds across blockchain ecosystems.