Community Trust ScoreVerified
Blockchain analytics firm Elliptic reported that money launderers associated with the $6.4 billion Binance hack used six throwaway memecoins to obfuscate the movement of stolen NEAR tokens, according to The Block.
Earlier reporting: Binance shuts down Bitcoin mining pool Nov 10 as hashrate falls 65%.
Earlier reporting: Binance revokes SignalPlus API keys after fake Teams invite breach.
In a report released Monday, Elliptic stated that approximately 117,000 NEAR, valued at roughly $430,000 at the time, were routed into six newly created tokens between Nov. 5 and Nov. 7. The firm identified this activity as part of a broader effort to move funds stolen in the attack, which the FBI has linked to North Korea.
Memecoin structure and design
The six tokens followed common memecoin aesthetics, featuring animal mascots and one ticker containing an expletive. Another token displayed an image of Elon Musk under the banner “Elon 2028 President.” Elliptic noted that there was no suggestion that Musk himself was linked to the token or the laundering scheme.
The mechanism relied on decentralized exchange liquidity pools to separate the wallets holding the stolen funds from the wallets collecting the proceeds. One set of wallets purchased the memecoins using the stolen NEAR, while a separate set of wallets sold the tokens into the pool to collect NEAR in return.
“At no point do the stolen funds move directly from a buying wallet to a collecting wallet, because the pool sits in between,” Elliptic wrote in the report. “To a casual observer, the collecting wallets look like ordinary traders who have sold a token at a profit.”
Precedent in Bybit hack
All six tokens have since been abandoned. Elliptic said much of the NEAR collected through these sales was subsequently moved into stablecoins or cross-chain bridges. The firm indicated that these additional swaps are intended to slow investigators down, providing a brief window for launderers to move funds before the wallets are flagged.
Elliptic observed that this specific tactic mirrors activity seen following the 2025 Bybit hack. In that case, launderers moved approximately $24 million through a homemade token paired with a stablecoin on the Tron network. In the current Binance case, Elliptic also found evidence of a similar approach on Solana, where existing tokens with low liquidity were used.
The transfers remain public and traceable on the blockchain. The volume of funds moved through the six NEAR tokens is small relative to the total 11.8 million NEAR stolen in the hack, which is worth around $42.7 million at current prices.
This report follows an update from Elliptic on Friday, which tracked roughly $124 million in stolen assets converted into bitcoin. Binance’s earlier incident report stated that the attack had been in the works for months and involved malicious developer software, a fake job interview, and compromised AI tooling.
Source: The Block
