North Korea Uses DeFi Liquidity Pools and Fake Tokens to Move Stolen Binance Cryptocurrency - GBHackers News
North Korean launderers created worthless meme tokens to route approximately $430,000 in stolen Binance cryptocurrency through decentralized exchange liquidity pools.
Approximately 117,000 NEAR tokens, valued at $430,000, passed through six disposable tokens created by North Korean launderers. This method replaces direct wallet transfers with seemingly routine trading activity, complicating transaction tracing while leaving blockchain evidence intact. The FBI attributed the theft to North Korea's TraderTraitor group on October 31, 2026.
The laundering process begins with attackers creating a token and pairing it with a legitimate asset like NEAR or a stablecoin within a decentralized exchange pool. One group of wallets spends stolen cryptocurrency to purchase the token, while another group sells tokens into the same pool and withdraws the valuable asset.
Laundering Technique
Between November 5 and 7, launderers created FUK, OLCCL, MEILI, MMLI, DABI and SINU on NEAR. Each token cost approximately 25 NEAR ($90) to launch and had its own NEAR liquidity pool. Trading patterns indicated coordinated laundering rather than genuine speculative interest.
The approach echoes earlier laundering associated with the 2025 Bybit theft.
Broader Operation
These transactions formed part of a larger operation involving more than 20,000 wallets, 16 blockchains, at least 36 services and 65,000 transactions by November 9. Elliptic assessed the activity as automated but found no evidence of AI-directed decision-making.
For compliance teams, liquidity-pool proceeds require scrutiny, not automatic acceptance. Newly launched tokens, concentrated counterparties, rapidly recycled funding and matching inflows and outflows can expose laundering. Elliptic emphasizes that conversion is not cash-out, as centralized exchanges and brokers remain potential interception points when attackers attempt to monetize stolen assets.
Related
