Elliptic, a blockchain analytics firm, says North Korean hackers linked to the recent Binance exploit are laundering stolen cryptocurrency by creating and using meme‑style tokens on the NEAR blockchain.
Method of laundering
The attackers first generated new tokens on publicly available launch platforms. Each token was paired with a legitimate asset such as NEAR or a stablecoin in a liquidity pool on a decentralized exchange (DEX). The stolen funds were then used to purchase the new tokens, and a separate set of wallets sold the tokens back into the same pool, withdrawing the legitimate assets. By routing the funds through the liquidity pool, the hackers avoided a direct transfer between the wallets holding the stolen crypto.
Tokens involved
Between 5 November and 7 November, at least six meme tokens were created on NEAR, named FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each token cost roughly 25 NEAR (about $90). In total, approximately 117,000 NEAR, valued at around $430,000, moved through these tokens before the liquidity was withdrawn.
Historical context
The same laundering technique was observed after the 2025 Bybit hack, where at least $24 million was moved through a worthless token on the Tron network. Elliptic notes that similar approaches have been identified across TRON, NEAR and Solana blockchains.
Attribution
The FBI has attributed the Binance theft to the North Korean state‑sponsored group TraderTraitor, while the cyber‑espionage group Kimsuky is reported to be increasing its use of AI tools in cyber operations.
