North Korea Launders Binance Hack Funds via NEAR Memecoins

Hackers linked to North Korea created six new memecoins on the NEAR blockchain to move about $430,000 stolen in the $6.4 billion Binance hack, blockchain analytics firm Elliptic said.

MoneyTurkey Crypto Desk | 9 November 2026

Key points

• Elliptic traced about $430,000 of the Binance haul through six tokens launched on NEAR between 5 and 7 November
• About 11.8 million stolen NEAR, which Elliptic valued at $43.7 million, had not moved at the time of its analysis
• The same method followed the $1.5 billion Bybit hack in 2025, when at least $24 million passed through a new TRON token

How it worked

The hackers used one set of wallets to swap stolen NEAR for the new memecoins on decentralised exchange liquidity pools, then a second set to sell the memecoins back into the pools for NEAR, Elliptic said. That moved funds between wallets without direct transfers, though every swap stayed visible onchain. The tokens drew almost no outside trading and were abandoned soon after launch.

Five of the six token creators were funded with proceeds from the previous token’s sales two to 13 minutes before the next launch, which links the tokens in one chain of transactions.

“North Korea’s launderers rarely rely on a single technique,” Elliptic co-founder Tom Robinson wrote. “Instead, they layer many cheap techniques, each adding a little more delay.”

Why it matters

Short-lived tokens add cheap steps that slow tracing without breaking the trail. With most of the stolen NEAR still parked, any further movement would be the next signal for exchanges and tracers.

What to watch

• Movement of the remaining 11.8 million stolen NEAR
• New NEAR or TRON tokens funded minutes before launch

Related on MoneyTurkey

• Crypto movers: Ether falls 4.2%, Bitcoin near $75,000
• Mercado Bitcoin Reopens After Hack, Withdrawals Stay Shut

For information only. Not investment advice.

Sources

• Cointelegraph, citing Elliptic