Original report published November 10, 2026, at 03:36:02 UTC+8.
Heavy trading in a newly launched token is not necessarily evidence of adoption. In research reported by Decrypt, blockchain analytics firm Elliptic described how North Korean hackers used self-created meme coins to move a portion of the reported $6.4 billion stolen from Binance through decentralized exchanges.
The activity generated trading volume, but Elliptic attributed it to laundering—not independent demand or durable use.
Six tokens, roughly $430,000 in flows
The clearest example involved Near. Between November 5 and 7, the launderers created at least six tokens, each with its own liquidity pool paired against NEAR. Each token cost about 25 NEAR, roughly $90, to create.
The tokens used familiar meme-coin imagery, including a bow-wearing monkey, a flag-draped duck, a chimpanzee and a fox. One featured an “Elon 2028 President” image of Elon Musk, who had no connection to the tokens. Names included FUK and SINU.
According to Elliptic, all six followed the same pattern: launch, heavy trading within hours using stolen NEAR, then abandonment. Remaining liquidity was withdrawn on November 8.
About 117,000 NEAR, worth roughly $430,000, passed through the six tokens, before much of the money moved into stablecoins or a cross-chain bridge. That figure describes funds routed through the pools; it is not a measure of unique users, customer growth or retention.
How the pools separated the wallets
Elliptic’s research, credited to co-founder Tom Robinson, described a process in which the launderers:
- Created a token and paired it with an established asset, such as NEAR or a stablecoin, in a liquidity pool.
- Used one set of wallets to buy the token with stolen funds.
- Sold tokens through a separate set of wallets to withdraw assets that appeared to be ordinary trading proceeds.
Because the liquidity pool sat between the wallets, there was no direct transfer of stolen funds from the buying wallet to the collecting wallet. Elliptic reported the tactic on Tron and Near, with a close variant on Solana.
An investigative obstacle, not an erased trail
Elliptic stressed that the funds remained fully traceable onchain. The maneuver was intended to slow investigators and buy time before funds were flagged, rather than make the money untraceable.
The roughly $430,000 routed through the six Near tokens was modest relative to the reported theft. Elliptic had earlier found that more than $3 billion of the stolen crypto remained unlaundered. It also reported that the launderers were creating a new wallet roughly every 25 seconds.
The firm first observed this tactic the previous year while tracing the $1.5 billion Bybit theft, which was also attributed to TraderTraitor, the group linked to the Binance breach.
For adoption analysis, the case illustrates a limitation of transaction and volume metrics: intense activity around fresh tokens can reflect coordinated fund movements rather than a growing user base. For compliance teams, Elliptic warned that receipts from liquidity pools should not automatically be treated as clean, particularly when newly minted tokens and a small group of trading wallets are involved.
