North Korean Hackers Leveraged Newly Created Memecoins on NEAR Blockchain to Launder Stolen Binance Funds

Latest News Published Nov 9, 2026

North Korean hackers have employed a sophisticated laundering strategy, creating six new memecoins on the NEAR blockchain to obscure their tracks after the massive $6.3 billion Binance hack. Blockchain analytics firm Elliptic has revealed that these newly minted tokens were instrumental in routing approximately $430,000 of the stolen cryptocurrency, utilizing liquidity pools on decentralized exchanges to mask the movement of funds between various wallets.

The report details how, between November 5th and 7th, 2026, the perpetrators established at least six distinct tokens on the NEAR protocol. Their method involved leveraging liquidity pools on decentralized exchanges (DEXs). This allowed them to swap the stolen NEAR tokens for these new memecoins, and subsequently, sell those memecoins back into the liquidity pools for NEAR. This intricate process, while not entirely obscuring the on-chain trail, effectively bypassed direct wallet-to-wallet transfers, adding layers of complexity for investigators. Crucially, these tokens attracted minimal external trading activity and were quickly abandoned after their short-lived deployment, suggesting their sole purpose was for illicit fund movement.

Elliptic’s analysis further uncovered a deliberate and rapid creation process for these tokens. The firm identified that five of the six token creators were funded with proceeds from earlier token sales just minutes before the subsequent token’s launch. This temporal proximity strongly links the tokens in a carefully orchestrated chain of transactions, designed to facilitate the laundering operation.

Tom Robinson, co-founder of Elliptic, commented on the hackers’ modus operandi, stating, "North Korea’s launderers rarely rely on a single technique. Instead, they layer many cheap techniques, each adding a little more delay." This statement underscores the methodical and persistent nature of North Korean cybercrime operations, which consistently seek to exploit various vulnerabilities and methods to obfuscate illicit gains.

This is not the first instance of North Korean-linked actors employing such tactics. Elliptic noted that a similar laundering technique was observed following the $1.5 billion Bybit hack in 2025. In that incident, North Korean-affiliated entities moved at least $24 million through a newly created token on the TRON blockchain, mirroring the strategy seen on the NEAR network. This recurring pattern highlights the adaptability and continuous refinement of their illicit financial strategies.

As of the time of Elliptic’s analysis, a significant portion of the NEAR tokens stolen in the Binance hack remained untouched. Approximately 11.8 million NEAR, valued at $43.7 million at the time, had not yet been moved. This indicates that while the hackers attempted to obscure their movements, a substantial amount of the illicitly obtained funds were still identifiable on the blockchain.

The Binance hack, a colossal breach in the cryptocurrency world, has continued to be a focal point for investigations into illicit finance. The involvement of state-sponsored actors, such as those linked to North Korea, raises significant geopolitical and cybersecurity concerns. The ability of these actors to adapt and leverage emerging technologies like decentralized finance (DeFi) and memecoins for criminal purposes presents an ongoing challenge for law enforcement and cybersecurity firms.

The NEAR blockchain, a popular platform for decentralized applications, has now become a case study in how even robust blockchain technology can be exploited when combined with malicious intent and sophisticated laundering techniques. The transparency of blockchain, while generally a strength, can be manipulated through complex layering and obfuscation methods, making it imperative for analytics firms and regulatory bodies to stay ahead of these evolving threats.

The investigation by Elliptic serves as a critical reminder of the persistent threat posed by North Korean cybercrime syndicates, which continue to generate revenue through sophisticated digital heists and subsequent complex laundering operations. The ongoing efforts to trace and recover these stolen funds underscore the vital role of blockchain analytics in combating cybercrime and maintaining the integrity of the digital asset ecosystem. The case also highlights the need for enhanced collaboration between blockchain platforms, cybersecurity experts, and international law enforcement agencies to effectively counter these transnational criminal activities.

The inherent anonymity and decentralization of certain aspects of the cryptocurrency space provide fertile ground for illicit actors. However, the immutable nature of blockchain transactions, even when complexly routed, offers a digital ledger that can, with meticulous analysis, reveal the flow of funds. Elliptic’s detailed report on this operation is a testament to the ongoing advancements in blockchain forensics and the continuous efforts to bring perpetrators of cryptocurrency theft to justice. The incident further emphasizes the importance of security protocols and due diligence for all participants in the cryptocurrency market, from exchanges to individual investors.