Laundering meme coins tied to Binance hack traded again on 9 Nov

On 9 November, 19,400 NEAR (about $70,000) was paid into two home-made tokens in 249 buys between 12:04 and 18:21 UTC, NEAR blockchain records show.NEAR chain read of the six Smithii tokens: pools, buys, creators, outside wallets (summary). NEAR is the coin of a blockchain of the same name. The same day, the blockchain analytics firm Elliptic wrote that “None of the six has traded since November 8”.Elliptic, North Korea is minting meme coins to launder the Binance hack, 9 November 2026.

Elliptic ties the six tokens to North Korea’s laundering of the $6.4bn Binance theft. How the attackers got in is the chain we traced on 5 November: Binance’s own findings lead from a fake recruiter to an internal signing service.The S-Curve, How a fake job interview reached Binance’s signing service, 5 November 2026. CoinDesk reported that the FBI attributed the attack to North Korea’s TraderTraitor group, which is associated with Lazarus.CoinDesk, EU entity suspected of losing $106 million from crypto exchange, 2 November 2026. A headline in The Block said Kim Jong Un’s sister rejects the FBI’s claims linking North Korea to the hack.The Block headlines, 2 November 2026.

How a meme coin launders

A meme coin is a token anyone can create, usually with a joke logo and no business behind it. Elliptic, which sells screening services to compliance teams, wrote that North Korea’s launderers are creating their own worthless tokens. They then use them to move stolen cryptoassets through decentralized exchange liquidity pools, so that no funds pass directly from the wallets holding stolen assets to the wallets that receive them. A liquidity pool is a shared pot of two assets that anyone can trade against, with no company matching buyers to sellers.

In practice there are four steps. Someone creates a token. They fill a pool that pairs it with wrapped NEAR, which is NEAR packaged so that it can be traded like any other token. Wallets holding stolen funds buy the token out of that pool. Fresh wallets then sell it back and collect the money. Our read of the chain found each of the six tokens paired with wrapped NEAR in its own pool on Ref Finance, a decentralized exchange.Ref Finance pools 9005 to 9013 read from v2.ref-finance.near get_pools.

The buys were mechanical. Most went through a swap router, a service that finds the best price for a trade, in round amounts of 30, 50 or 100 NEAR, and the rest went straight to Ref Finance.Every wrapped-NEAR swap into the six token pools, with signer, route and tokens received.

The result looks like speculation. Elliptic wrote that a wallet whose history shows trades in a new meme coin looks like a speculator rather than a launderer, unless someone checks where its money came from. It also wrote that the technique slows investigators down rather than hiding the funds, and that each token is cheap enough to throw away. Each cost about 25 NEAR (around $90) to create, Elliptic wrote. The logos include a duck in front of a US flag and a chimpanzee, Elliptic wrote.

The method is not new. Elliptic first reported its use in the laundering of the funds stolen from Bybit in 2025, moving at least $24M this way. For the Binance case, Elliptic wrote, it has seen the technique on Tron and NEAR, along with a closely related approach on Solana.

The numbers on the chain

Our read counts 117,683 NEAR paid into the six pools through 8 November. Elliptic put the figure at about 117,000 NEAR (around $430,000). The two counts agree.

The tokens differ in size. The one called FUK was created through a public token-launch tool on 5 November at 00:25 UTC, and 25,921 NEAR was paid in. For OLCCL the figure is 40,002 NEAR, created on 6 November. For SINU it is 24,273 NEAR, created on 7 November. Across all six pools, 137,083 NEAR was paid in between 5 and 9 November.

Four of the six pools have had their liquidity withdrawn. The one for FUK held 13.3 wrapped NEAR on 9 November. The two still funded are the ones that traded again. The MMLI pool held 508.4 wrapped NEAR, and the SINU pool held 643.5.

Did any meme-coin traders bite?

Almost none did. Elliptic wrote: “Nobody else traded them.” It adds that the only outside activity was a handful of small purchases of FUK on its first day, less than 1% of its volume.

Our read found two small cases. One wallet with no funding link to the network put in 0.02 NEAR on 5 November at 06:34 UTC and sold the tokens back at 07:44 UTC. On 9 November at 15:27 UTC, a trading-bot account bought and sold 1.16 SINU in the same minute.

Four other wallets look like ordinary buyers. They bought FUK one after another between 5 November at 14:00 UTC and 6 November at 03:53 UTC, spending 304 NEAR, and never sold. Their funding points back to the laundering side. One wallet sent 100 NEAR to one of the four on 6 November, then sent 98.8 and 99.979 NEAR to a FUK buying wallet that traded in step with the laundering sellers. Later that day, one of the four sent 64.2 NEAR to the FUK creator, and a minute later the creator sent 187.5 NEAR to an address on Elliptic’s blocklist. The four also pass funds among themselves.

The FUK creator also sent 5 NEAR to another wallet on 5 November, which still holds FUK.

What it means for screening

Some of the money was stopped early. Stablecoin issuers, Aave’s emergency guardian and Arbitrum’s council each froze stolen funds on 29 October, as we reported on 10 November.The S-Curve, Who could freeze the Binance loot, and how long each key took, 10 November 2026.

Elliptic’s public blocklist held 21,234 addresses, on 9 November, of which 122 look like NEAR accounts. The creators and most buying wallets of the six tokens are not on it, though several sellers are.

Elliptic’s advice to compliance teams is that they should not treat funds arriving from a liquidity pool as clean by default, particularly where newly created tokens are involved. It also wrote that the token-launch tool, the exchange and the wallet app did nothing wrong, and that the launderers simply used them as any other user could.

The method can run for a long time yet. Elliptic says about 11.8M NEAR ($43.7M) from the theft has not yet moved, and the two pools that traded again on 9 November still held 508.4 and 643.5 wrapped NEAR.