Binance hackers launder $430,000 through memecoins on NEAR
Blockchain analysts at Elliptic spotted six throwaway tokens, minted Nov. 5 to 7, moving a sliver of the loot the FBI ties to North Korea.
The hackers who drained Binance on Oct. 29 minted at least six memecoins on the NEAR blockchain to move part of the haul, according to an analysis the firm Elliptic published Nov. 9. The tokens appeared between Nov. 5 and 7. None has traded since Nov. 8.
About 117,000 NEAR, roughly $430,000, flowed through them. That is small: Elliptic estimates another 11.8 million NEAR, about $43.7 million, has not moved.
A memecoin is a token with no backing and no use, worth whatever someone will pay for it. Each of these cost about 25 NEAR, or $90, to create with a public launch tool. The scheme works in three steps:
- The token goes into a liquidity pool next to NEAR on a decentralized exchange.
- One group of wallets puts stolen funds into the pool and takes out the token.
- A second group sells the token back to the pool and withdraws NEAR.
Because the pool sits in the middle, the money never travels from one wallet to another, and the transfer looks like an ordinary trader's profit.
Almost none of that trading is real. Wallets in the laundering network made every sale of all six tokens and every purchase of five. In FUK, the only token with outside buyers, those purchases were small and came to less than 1% of its volume. The price of these tokens measures nobody's interest.
The method does not hide the funds, Elliptic says. The route stays visible on the blockchain, and the payoff for the thieves is time. The firm urges compliance teams not to treat money coming out of a pool as clean. It saw the same pattern Nov. 2 with a worthless token on Tron and the next day on Solana, where stolen SOL was swapped for thinly traded tokens.
Elliptic puts the total theft at $6.43 billion and has verified $2.85 billion as frozen or seized, 44% of the total. The FBI blamed North Korea and asked companies to block the addresses used. Binance's own report traces the intrusion to a fake recruiter. The NEAR figures come from Elliptic alone.
