Elliptic traced 117,000 NEAR tokens, valued at roughly $430,000, through six disposable meme coins launched by North Korean launderers between November 5 and November 7. This sum represents a small slice of the approximately $6.3 billion stolen from Binance on October 29, an attack the FBI attributed to the TraderTraitor hacking group. The firm reported that these specific tokens were designed to shuffle funds through decentralized exchange liquidity pools, breaking the direct link between wallets holding stolen assets and those collecting proceeds. By inserting a pool in the middle, the launderers ensure no transfer connects the two groups directly, making the collecting wallets appear as ordinary traders who sold a token for profit.
Six Tokens, One Chain of Wallets
The six NEAR tokens, named FUK, OLCCL, MEILI, MMLI, DABI, and SINU, carried cartoonish artwork including a monkey with a pink bow and a duck posed against an American flag. One token displayed Elon Musk beneath an "Elon 2028 President" banner, though Elliptic stated there is no suggestion Musk has any link to them. Each token cost about 25 NEAR, or around $90, to launch, a low barrier that allows for rapid deployment. The trading data reveals that outside traders were almost entirely absent, with laundering wallets placing every sell order in all six tokens and every purchase in five of them. The only exception was a sliver of FUK buys on launch day, confirming the tokens served no purpose beyond laundering.
These tokens were linked in a chain where the wallet bankrolling a new creator had dumped the prior token just 2 to 13 minutes before the next launch. This sequence shows that profits from one token financed the next, creating a continuous flow of obfuscated funds. None of the tokens has traded since November 8, when four creators pulled the remaining funds from their pools. Jonty, founder of Pangolin Intelligence, noted days earlier that these networks shuffle funds to evade transaction monitoring software like Chainalysis and TRM Labs. The technique slows investigators down rather than hiding the funds, as every step remains visible onchain.
A Tactic First Seen With Bybit
This method is not new; Elliptic first observed it after the 2025 Bybit hack, where launderers used a worthless Tron token to move at least $24 million. In the current Binance case, a similar Tron token appeared on November 2, followed by stolen Solana tokens moving through existing thinly traded Solana tokens on November 3. The NEAR sums moved so far are small compared to the 11.8 million NEAR, worth $43.7 million, that remains unmoved from the original hack. Tom Robinson, writing for Elliptic, advised compliance teams not to treat funds coming out of a liquidity pool as clean by default. He listed warning signs such as tokens only days old, pools with a handful of traders, and wallets that only buy or only sell.
The firm emphasized that the decentralized exchanges and tools used did nothing wrong, as the launderers simply used them as any other user could. Much of the collected NEAR went into stablecoins or cross-chain bridges, further complicating the trail. The additional swaps act as hurdles to give launderers extra time to move funds before their wallets get flagged. While the amounts are currently modest, the cheap cost of launching these tokens means they could carry far larger volumes in the future. Investigators must now look past the surface-level appearance of organic trading to identify these coordinated, short-lived schemes.
