near laundering memecoins: Six Throwaway Tokens Moved $430K of Binance Hack Funds

The near laundering memecoins found by Elliptic are a new twist on the Binance hack: North Korea-linked launderers created at least six throwaway tokens on NEAR between November 5 and 7 and pushed about 117,000 stolen NEAR, roughly $430,000, through them. Each token cost about 25 NEAR, around $90, to create, and all six were abandoned once the money had passed through.

What actually happened

Elliptic published the findings on November 9 in a report by Tom Robinson. The launderers used public token-launch tools to mint new coins, opened a pool pairing each coin with NEAR on a decentralized exchange, then used one set of wallets to buy the coin with stolen NEAR and a second set to sell it back and withdraw NEAR. Because the pool sits in the middle, no funds move directly from a wallet holding stolen assets to a wallet collecting them.

To a casual observer the collecting wallets look like lucky traders who sold a meme coin at a profit. CoinDesk, citing Elliptic, reports that outside buyers made up less than 1% of the volume in one of the tokens, meaning almost all trading came from wallets linked to the scheme. The Block adds that the tokens used animal mascots, one had an expletive ticker and one showed Elon Musk under an "Elon 2028 President" banner; Elliptic said there is no suggestion Musk had anything to do with it.

Elliptic also saw the same technique on Tron and a related route on Solana that used existing, thinly traded tokens instead of new ones. It first described this method in the laundering of funds stolen from Bybit in 2025.

Why the near laundering memecoins matter

The amounts are tiny next to the size of the theft. Elliptic describes the Binance case as a $6.4bn hack; other outlets use $6.3 billion. We covered the attack in binance 6.3b hack and the share of funds frozen early in elliptic binance freeze. What makes this report important is the method, not the dollar figure.

The trick is cheap. At about $90 per token, a launderer can mint dozens of single-use coins and throw them away. Elliptic stresses that the trail can still be followed on-chain and that the swaps only slow investigators down. Its advice to compliance teams is direct: do not treat funds arriving from a liquidity pool as clean by default, especially when a brand-new token is involved.

The token-launch tool, the exchange and the wallet app did nothing wrong, Elliptic says. The launderers used them like any other user.

The risk for ordinary traders

This is where the story touches the wider meme coin market. Fake tokens like these can show sudden volume spikes and price jumps that look like a real launch on trackers. Anyone scanning a "top gainers" list for new coins could mistake a laundering pool for organic interest and buy in, only to find the creators pull the liquidity a day later. That is exactly what happened with four of the six NEAR tokens.

We saw a related pattern after the hack in memecoins binance hack, when hack-themed tokens and copycats flooded several chains. The lesson is the same: volume alone proves nothing about who is trading.

What we could not verify

Elliptic does not name the DEX, the launch tool or the wallet app, and we did not trace the transactions ourselves. The dollar values depend on the NEAR price at the time of each report, so you will see small differences between outlets.

What to do as a reader

Read the Elliptic report in full before sharing claims about it. If you trade new tokens on NEAR or any other chain, check how old the contract is, who created it, how many separate wallets hold it and whether the liquidity is locked. Near laundering memecoins and similar fakes tend to show a burst of trades from a small cluster of wallets and then go silent.

Nothing here is investment advice. If a token's whole history is a few days of heavy volume followed by a liquidity pull, stay away.