Binance Hackers Launder $430K Via NEAR Memecoins
Binance Hackers Launder $430,000 Via NEAR Memecoins – Obfuscation Tactic Routes Stolen Funds Through Decentralized Exchanges
Key Takeaways
- North Korean hackers laundered roughly $430,000 from the Binance exploit using newly created memecoins on the Near Protocol.
- The obfuscation technique routes stolen cryptocurrency through decentralized exchange liquidity pools to prevent direct wallet tracking.
- Blockchain analytics firm Elliptic identified similar methods previously used during the 2025 Bybit hack.
North Korean Hackers Exploit Decentralized Liquidity Pools
The repercussions of the Binance exploit continue to unfold as North Korean hackers adopt new methods to obscure stolen funds. Blockchain analytics firm Elliptic reports that these perpetrators are creating their own worthless meme tokens to launder cryptocurrency. This approach avoids direct transfers between wallets holding stolen funds and those receiving the laundered assets.
Hackers initiate this process using publicly available token-launch platforms. They pair the newly minted token with a legitimate asset, such as Near Protocol (NEAR) or a stablecoin, inside a liquidity pool on a decentralized exchange. Wallets containing the stolen cryptocurrency then purchase the new meme token from this pool.
A separate set of wallets subsequently sells the worthless tokens back into the same liquidity pool. This mechanism allows the operators to withdraw legitimate crypto assets on the other side. Investigators face a much harder and more time-consuming task tracing the money because the liquidity pool sits directly between the buying and selling wallets.
Memecoin Creation Masks Movement of $430,000 in NEAR
Perpetrators created at least six different memecoins on the NEAR network between the 5th and 7th of November. These tokens cost approximately 25 NEAR, or $90, to deploy. They carry classic meme coin style logos and names ranging from crude jokes like FUK to dog-themed coins like SINU, including OLCCL, MEILI, MMLI, and DABI.
Roughly 117,000 NEAR passed through these specific tokens during the laundering cycle. This volume amounts to a total value of approximately $430,000. Trading patterns across these assets looked identical during this brief time frame.
The tokens experienced heavy trading volume within hours of their creation. Hackers completely abandoned the projects shortly after completing the laundering cycle. Some instances also saw the immediate withdrawal of any remaining liquidity from the exchange pools.
Laundering Tactic Mirrors the 2025 Bybit Exploit
This specific routing technique is not an entirely new development for blockchain investigators. Elliptic observed the same method during the laundering of funds from the Bybit hack in 2025. Those perpetrators moved at least $24 million through a worthless token minted on the Tron network.
Analytics show the approach has now expanded across multiple blockchain environments. Investigators have identified its use on networks including Tron (TRX), NEAR, and Solana (SOL). The FBI recently attributed the underlying theft to TraderTraitor, a state-sponsored hacking group from North Korea.
North Korean cyber operations continue to evolve their technological capabilities alongside these on-chain maneuvers. The cyber-espionage group Kimsuky is actively integrating artificial intelligence tools to strengthen its wider digital attacks.
Our Assessment
The deployment of custom memecoins to launder stolen funds demonstrates a clear evolution in on-chain obfuscation tactics. Utilizing decentralized exchange liquidity pools disrupts the direct wallet-to-wallet tracing that blockchain investigators rely upon. The repeated use of this strategy across Tron, Solana, and NEAR indicates that state-sponsored groups view it as an effective method for processing illicit capital. The low cost of deploying these tokens allows hackers to cycle through multiple assets quickly, minimizing their footprint on any single decentralized exchange.
We have imposed strict editorial guidelines on ourselves and explain our testing methods openly and comprehensively. We also communicate transparently how our work is financed. This site may contain tracking links, but this does not influence our objective view in any way.
