Elliptic Says Binance Hack Funds Went Through Six Homemade Tokens
About 117,000 stolen NEAR, roughly $430,000, passed through tokens that cost about $90 each to make. Nobody outside the network traded them, Elliptic says.
Launderers moving money from the Binance hack created at least six meme tokens on the NEAR blockchain and pushed about 117,000 stolen NEAR, roughly $430,000, through them between Nov. 5 and 7, blockchain analytics firm Elliptic said Monday.
Elliptic values the Oct. 29 theft at $6.4 billion. The FBI said Oct. 31 that North Korea was responsible, a finding North Korea rejected, Black Mint reported Nov. 2.
How the token trick works
A liquidity pool is a pot of two tokens on a decentralized exchange that anyone can swap against. Elliptic said the launderers made a new token, paired it with NEAR in its own pool, and bought the token with stolen NEAR from one set of wallets. A second set of wallets then sold the token back into the same pool and took out NEAR. The stolen funds never moved straight from one wallet to the other, so the sellers looked like traders who had made a profit.
Each token cost about 25 NEAR (around $90) to create, Elliptic said. The tokens carried cartoon-style logos, including one with Elon Musk's image, and Elliptic said there is no suggestion he has any connection to them.
Nobody else was buying
Wallets in the laundering network made every sale of all six tokens, according to the report. Outside buyers showed up only in a few small purchases of one token, under 1% of its volume. Five of the six token creators were paid from a wallet selling the previous token, 2 to 13 minutes before each launch. None of the six has traded since Nov. 8.
Elliptic said the launderers used the same idea on Tron on Nov. 2 and a related route on Solana on Nov. 3. It first saw the method in the 2025 Bybit case, where at least $24 million moved this way.
The token-launch tool, exchange and wallet app involved "did nothing wrong," Elliptic said.
Elliptic told compliance teams not to treat funds arriving from a liquidity pool as clean by default, especially when newly created tokens are involved. About 11.8 million NEAR ($43.7 million) from the Binance theft has not moved yet.
Sources: Elliptic: North Korea is minting meme coins to launder the Binance hack (Nov. 9, · Elliptic: How North Korea is laundering the $6.4 billion stolen from Binance · FBI: North Korea Responsible for $6 Billion+ Binance Attack (Oct. 31, 2026) · Black Mint: North Korea Denies FBI Finding It Stole $6 Billion From Binance (Nov
Revisions
First published .
No revisions since publication.
We fix errors and say so. See every correction on the Blackmint corrections page.