North Korean cryptocurrency launderers are manufacturing worthless meme tokens and routing stolen Binance assets through decentralized exchange liquidity pools, replacing direct wallet transfers with apparently routine trading activity.
Approximately 117,000 NEAR, valued at $430,000, passed through six disposable tokens. Although modest compared with the overall theft, the activity demonstrates a cheap, repeatable laundering mechanism that complicates transaction tracing without eliminating the underlying blockchain evidence.
Elliptic’s initial investigation reported that attackers drained Binance wallets across 11 blockchains on October 29, 2026.
According to that report, the FBI attributed the theft to North Korea’s TraderTraitor group on October 31, linking the incident to an established cryptocurrency theft operation.
The laundering process starts with an attacker creating a token and pairing it with a legitimate asset, such as NEAR or a stablecoin, inside a decentralized exchange pool.
One group of wallets spends stolen cryptocurrency to purchase the token. Another group sells tokens into the same pool and withdraws the valuable asset.
This arrangement removes the direct transfer between the wallets holding stolen funds and those collecting the proceeds. The receiving wallets instead appear to earn money by selling tokens, while the liquidity pool becomes the intermediary.
Elliptic identified the technique, on Tron and NEAR, alongside a related Solana variant, during its investigation into the $6.43 billion Binance theft.
DeFi Liquidity Pools
Elliptic’s laundering timeline documents these pool-based transfers alongside bridges, lending vaults and asset swaps.
The distinction matters: the funds have not become untraceable. Investigators must reconstruct token creation, pool transactions, wallet funding and subsequent withdrawals rather than follow a straightforward payment.
Between November 5 and 7, the launderers created FUK, OLCCL, MEILI, MMLI, DABI and SINU on NEAR, according to the supplied research. Each token cost approximately 25 NEAR, or $90, to launch and had its own NEAR liquidity pool.
The trading patterns indicated coordinated laundering rather than genuine speculative interest. Network-controlled wallets executed every sale across all six tokens and bought every unit of five.
Outside purchases of FUK represented less than 1% of its volume. DABI, MMLI and SINU each involved just one buying wallet and one selling wallet.
Funding relationships provided another connection. Five token creators received funds from wallets already selling an earlier token, between two and 13 minutes before launching the next.
Each token began selling within three hours, concentrated at least three-quarters of trading into one day, and then stopped trading.
The approach echoes earlier laundering associated with the 2025 Bybit theft. In the Binance operation, Elliptic identified a purpose-built Tron token on November 2.
The following day, stolen SOL moved through existing wrapped and thinly traded tokens before conversion into USDC and transfers across blockchains.
These transactions formed part of a broader operation involving more than 20,000 wallets, 16 blockchains, at least 36 services and 65,000 transactions by November 9.
Elliptic assessed the activity as automated but found no evidence establishing AI-directed decision-making.
For compliance teams, liquidity-pool proceeds require scrutiny, not automatic acceptance. Newly launched tokens, concentrated counterparties, rapidly recycled funding and matching inflows and outflows can expose laundering.
Elliptic also emphasizes that conversion is not cash-out: centralized exchanges and brokers remain potential interception points when attackers eventually attempt to monetize stolen assets.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.