North Korean Hackers Used NEAR Tokens to Move Stolen Binance Funds

North Korean hackers created memecoins to launder cryptocurrency stolen within the $6.3 billion Binance hack, routing roughly $430,000 by six newly launched tokens on the NEAR blockchain, in accordance to a report from blockchain analytics agency Elliptic.

Between Nov. 5 and seven, the hackers created at the very least six tokens on NEAR and used liquidity swimming pools on decentralized exchanges to transfer stolen funds between wallets, Elliptic said. The tokens attracted nearly no outdoors buying and selling and have been deserted shortly after launch.

The hackers used one set of wallets to swap stolen NEAR tokens for the brand new memecoins, then used one other set to promote these memecoins again into the swimming pools for NEAR. The swaps allow them to transfer funds with out direct wallet-to-wallet transfers, although the transactions remained traceable onchain.

How stolen NEAR moved between wallets by liquidity swimming pools. Supply: Elliptic

Elliptic additionally discovered that 5 of the six token creators have been funded with proceeds from earlier token gross sales simply two to 13 minutes earlier than the subsequent launch, linking the tokens in a sequence of transactions.

“North Korea’s launderers not often depend on a single approach,” Elliptic co-founder Tom Robinson wrote within the report. “As a substitute, they layer many low-cost methods, every including a little bit extra delay.”

Elliptic stated the identical laundering approach was additionally used following the $1.5 billion Bybit hack in 2025, when North Korean-linked actors moved at the very least $24 million by a newly created token on the TRON blockchain.

On the time of Elliptic’s evaluation, about 11.8 million NEAR stolen within the Binance hack remained unmoved. Elliptic valued these funds at $43.7 million.

Journal: Vitalik ‘pivots’ ETH to store of value, crypto suffers after US midterms: Hodler’s Digest