Original report published by Decrypt on November 10, 2026, at 03:36:02 UTC+8. This article reflects that reporting period.
Launderers linked to North Korea used newly created meme coins and decentralized-exchange liquidity pools to move a portion of the reported $6.4 billion stolen from Binance, according to Elliptic research cited by Decrypt. The mechanism complicates the relationship between wallets without making the funds untraceable.
The distinction matters: routing assets through a pool can remove a direct transfer between two wallets, but Elliptic said the underlying trail remains fully traceable onchain.
The mechanism: a pool between the wallets
In research credited to Elliptic co-founder Tom Robinson, the blockchain analytics firm described a sequence built around tokens created by the launderers themselves:
- Create a new, otherwise worthless meme token.
- Establish a liquidity pool pairing it with an asset such as NEAR or a stablecoin.
- Use one set of wallets to spend stolen assets buying the token through the pool.
- Use a separate set of wallets to sell the token into the pool and collect the paired asset.
The pool acts as an intermediary. Stolen assets do not move directly from the buying wallet to the wallet collecting the proceeds, whose activity can instead resemble an ordinary trader selling a meme coin. That appearance does not establish that the proceeds are legitimate.
Elliptic reported observing the tactic on Tron and Near, with a closely related variant on Solana.
The Near example: six tokens and roughly $430,000
The clearest example in the report involved at least six tokens created on Near between November 5 and 7, each with its own NEAR liquidity pool.
Their branding included cartoon animals—a bow-wearing monkey, a flag-draped duck, a chimpanzee and a fox—and an “Elon 2028 President” image. Elon Musk had no connection to the tokens. Names included FUK and SINU.
Each token cost approximately 25 NEAR, or roughly $90, to create. According to the report, all six followed the same pattern: launch, heavy trading using stolen NEAR within hours, then abandonment. The remaining liquidity was withdrawn on November 8.
About 117,000 NEAR, worth roughly $430,000, passed through the six tokens. Much of that subsequently moved into stablecoins or a cross-chain bridge. These figures describe the six-token example, not the total amount laundered from the Binance theft.
Traceability remains; investigation takes longer
Elliptic characterized the tactic as a way to delay investigators rather than conceal the trail completely. The disposable tokens and intermediary pools add another layer to a race to move funds before they are flagged.
The firm had previously reported that more than $3 billion of the stolen crypto remained unlaundered and that the launderers were creating a new wallet roughly every 25 seconds. The meme-coin activity therefore represented a relatively small component of the reported haul.
Elliptic said it first observed the tactic the previous year while tracing the $1.5 billion Bybit theft. That theft was also attributed to TraderTraitor, the group identified in the report as responsible for the Binance breach.
For compliance teams, Elliptic’s warning was specific: receipt from a liquidity pool is not evidence that funds are clean, particularly when activity involves newly minted tokens and a small group of trading wallets. The reported mechanism changes the route between wallets—not the traceability of the underlying transactions.