Blockchain analytics firm Elliptic published on November 9, 2026, a new laundering technique used for the funds taken in the October Binance hack of $6.4 billion. North Korean launderers – tied to the TraderTraitor subgroup inside Lazarus – are minting their own meme coins and pushing part of the stolen amount through them.
How the home-made meme coin scheme works on NEAR and Tron
The technique runs in four steps.
The launderers mint a new token through any of the public launch tools available on the chosen chain. They then pair it with a real asset – NEAR or a stablecoin – inside a liquidity pool on a decentralized exchange. The first set of wallets pours stolen crypto into the pool and takes the new token in return. A second set of wallets dumps the same token back into the pool and withdraws a “clean” asset – NEAR or stablecoins.
The token itself is dressed up as a standard meme coin. Logos feature a monkey wearing a pink bow, a duck in front of a US flag, a fox, Elon Musk under an “Elon 2028 President” banner. The names follow the same pattern: from the crude FUK to an echo of the “-INU” dog coins in the shape of SINU. Thousands of such coins appear on-chain every day, so one more with a cartoon logo and a silly name raises no flags on its own.
Six NEAR tokens and $430K in stolen funds
Elliptic first spotted the method back in 2025, during the laundering of the Bybit theft also attributed to TraderTraitor. At least $24M moved through a home-made token on Tron that time.
After the Binance hack the launderers rolled out the same playbook in early November. On November 2, Elliptic found a fresh home-made token on Tron created purely for laundering. On November 3, stolen SOL was swapped several times into thinly traded tokens on Solana, then into USDC and across a bridge to another blockchain. The Solana tokens were not home-made, but the aim was the same: to put some obscure asset between the stolen funds and the next wallet.
The clearest picture emerged on NEAR. Between November 5 and 7, the launderers minted six new meme coins, each paired with NEAR in its own pool: FUK launched on November 5 at 00:25 UTC, followed by four more (OLCCL, MEILI, MMLI and DABI) on November 6 between 07:19 and 14:27 UTC, and SINU on November 7 at 10:06 UTC. Each launch cost its creators about 25 NEAR (around $90).
Around 117,000 NEAR (roughly $430K) passed through all six pools combined. After November 8, none of the tokens traded again, and for four of them the creators themselves pulled the remaining liquidity out of the pools. The sum is small compared to the heist, but 11.8M NEAR (about $43.7M) from Binance still has not moved – and the same scheme can be scaled to any volume.
Three signs that the NEAR tokens were built for laundering
According to Elliptic, three signals in the data give the tokens away.
First, nobody else touched them. Across all six tokens, laundering-network wallets made every sale and every purchase (with the exception of FUK, which had a few outside buys on day one – less than 1% of volume). DABI, MMLI and SINU each had a single buyer wallet and a single seller wallet.
Second, each next token was paid for with the proceeds of the previous one. Five of the six token creators received their funding from a wallet that had been selling an earlier token 2 to 13 minutes before the new launch. The chain rolls neatly from one empty token into the next.
Third, the tokens were used instantly and thrown away. Each was first sold within three hours of launch, and 75% of its trading volume concentrated inside a single day. The amount of stolen NEAR flowing into the pool matched the amount of NEAR flowing out in every case.
What this means for compliance and address screening
For compliance teams, the takeaway is simple: a wallet that received its funds from a liquidity-pool swap should not be treated as clean by default. It may be sitting just two swaps away from a hack.
Four signals are worth watching: the token was created in the past few days; only a small number of wallets trade in the pool; some wallets only buy the token while others only sell it; the wallets are newly funded, usually right before they begin trading, often in round amounts.
The technique does not hide the funds – it slows down the investigators. Every extra hop costs time, and that time is the window launderers need before the first flag hits the monitoring systems. At $90 per token, such a disposable wrapper can be minted by the dozen.
