Elliptic Says North Korea-Linked Hackers Used Meme Coins to Move Binance Heist Funds

Elliptic has traced what blockchain analytics firm characterizes as a North Korea-linked laundering operation involving six meme tokens created on the NEAR blockchain between November 5 and November 7. The tokens were used to route approximately 117,000 NEAR, valued at about $430,000, through decentralized exchange liquidity pools. The amount represents only a small portion of the funds reported stolen from Binance, making the transfer a limited but revealing example of how proceeds can enter newly issued token markets.

The method described by Elliptic centers on wallets interacting with liquidity pools tied to tokens made specifically for the activity. Decrypt reports that the assets included cartoon-animal and Elon Musk logos and were effectively worthless, while Cointelegraph says the pools helped obscure transfers between wallets. Such steps place transactions inside the appearance of ordinary decentralized trading, adding intermediaries and newly created assets between the suspected source of the funds and their ultimate destination.

The cross-outlet accounts agree on the six-token structure, the NEAR routing and the roughly $430,000 traced by Elliptic. They differ modestly on the size of the underlying Binance theft: CoinEdition and Unchained use $6.3 billion, while TronWeekly and Protos report $6.4 billion. Decrypt supplies more detail about the tokens’ imagery, and Protos frames the operation more broadly, reporting the use of TRON-, Solana- and NEAR-based memecoins, a wider multi-chain element not stated by the other outlets.

The scale of the traced movement is much smaller than the reported Binance loss. Unchained characterizes the roughly $430,000 as a small slice of the stolen funds, while TronWeekly says the attackers used the tokens and decentralized exchange liquidity pools to move cryptocurrency connected to the hack. Elliptic’s attribution connects the activity to North Korea-linked attackers, but the supplied coverage does not identify individual wallets, provide an ultimate destination for the traced assets or state how much additional stolen crypto has passed through similar routes.

Live market context is mixed for NEAR, the blockchain named in Elliptic’s account. NEAR Protocol traded at $3.64, gaining 2.75% over 24 hours but declining 5.78% over seven days, with a $4.77 billion market capitalization. DeFiLlama listed NEAR’s total value locked at $112.2 million, down 1.0% over seven days. The broader crypto market capitalization stood at $2.57 trillion and was described as flat, while Bitcoin rose 0.57% over 24 hours.

The development matters because it illustrates how token creation and decentralized liquidity can complicate the path of stolen assets without requiring a large amount of capital to establish the described mechanism. It also shows that only a fraction of a major exchange loss may be visible in a particular token route at a given time. The immediate facts to monitor are whether Elliptic identifies further traced wallets or destinations, whether other assets or blockchains appear in related transfers, and whether the reported $6.3 billion to $6.4 billion range is refined. The overall Crypto Fear & Greed reading was 29, placing sentiment in the Fear category, while the wider market was broadly unchanged.