North Korean Hackers Flip Stolen Binance Funds Into NEAR Meme Coins
North Korea's TraderTraitor group has begun laundering $6.4 billion stolen from Binance through newly created meme tokens on the NEAR blockchain.
Between November 5-7, 2026, the hackers launched at least six meme tokens on NEAR: FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each token was paired with NEAR in a liquidity pool on a decentralized exchange, allowing stolen funds to be converted without direct transfers between wallets.
The operation cost approximately $90 per token launch, with 117,000 NEAR (about $421,000) moving through the scheme. Most of these funds were later converted into stablecoins or transferred via a cross-chain bridge.
Meme Token Technique
Each token featured typical meme branding, including monkeys and an image of Elon Musk under an "Elon 2028 President" banner. Elliptic noted that Musk has no connection to these tokens. The tokens were sold for the first time less than three hours after launch, with at least 75% of trading occurring within one day.
Laundering is a race to move funds before they are flagged.
Previous Similar Operations
This laundering technique isn't new. In 2025, after the Bybit hack, the same scheme moved at least $24 million through Tron by pairing worthless tokens with stablecoins. Elliptic also identified a similar token on Tron on November 2, 2026, and observed stolen SOL being swapped into existing thinly traded tokens on Solana.
Remaining Stolen Funds
So far, only a small portion of the stolen Binance funds has gone through meme tokens. Approximately 11.8 million NEAR from the theft remains unmoved, valued at around $42.4 million based on NEAR's current trading price of $3.60.
Elliptic advises compliance teams to scrutinize funds coming from liquidity pools, especially those containing newly created tokens, as this technique makes tracing funds slower while allowing hackers to create and abandon multiple tokens quickly.
Related
