North Korea-linked operators responsible for the record $6.4 billion theft from Binance have begun minting their own worthless meme tokens and routing stolen assets through decentralized-exchange liquidity pools, according to blockchain analytics firm Elliptic. The method places a newly created token between wallets holding stolen funds and those collecting the proceeds, so no direct on-chain transfer links the two sets of addresses.

The technique appeared most clearly on the NEAR blockchain between November 5 and 7. Launderers created at least six tokens—FUK, OLCCL, MEILI, MMLI, DABI and SINU—each paired with NEAR in its own liquidity pool. Stolen NEAR entered the pools through one group of wallets that bought the new tokens; a second group of wallets then sold the tokens back into the same pools and withdrew NEAR. Roughly 117,000 NEAR, valued at about $430,000 at the time, passed through the six tokens before much of the proceeds moved into stablecoins or crossed to other chains.

How the Disposable Tokens Operated

Each token cost approximately 25 NEAR, or about $90, to create. They carried typical meme-coin branding: cartoon logos featuring a monkey wearing a pink bow, a duck draped in a U.S. flag, a chimpanzee, a fox, and an image of Elon Musk under an “Elon 2028 President” banner. Elliptic noted that Musk has no connection to the tokens. Names ranged from a crude abbreviation to a play on popular dog-themed coins.

Trading followed a consistent pattern. Each token was first sold within three hours of launch and conducted at least three-quarters of its total volume within a single day. Outside participation was negligible—less than 1 percent of volume on the first token and none on several others. By November 8 the tokens had ceased trading, and the creators of four of them withdrew remaining liquidity from their pools. Five of the six token-creation wallets received funding from an address that had sold the previous token only minutes earlier, allowing the operation to finance itself.

Similar activity occurred on Tron and a related approach appeared on Solana. On Tron, a worthless token was identified on November 2. On Solana the following day, stolen SOL was swapped into existing thinly traded tokens before conversion into USDC. Elliptic first documented the core technique while tracing proceeds of the 2025 Bybit theft, also attributed to the same group, in which at least $24 million moved through a comparable Tron token and stablecoin pool.

Scale Relative to the Overall Theft

The $430,000 routed through the NEAR tokens represents a modest fraction of the total haul. The FBI attributed the October 29 Binance breach—spanning multiple blockchains—to the North Korean group known as TraderTraitor. Elliptic estimates that more than $3 billion of the stolen assets had still not been laundered at the time of its report, including approximately 11.8 million NEAR still sitting in linked addresses and valued at roughly $43 million.

Launderers have deployed automated wallet generation and layered techniques across dozens of services. The meme-token method adds one inexpensive, disposable layer among many. Because each token can be created for a low fixed cost and abandoned after a few hours of controlled trading, operators can generate many of them in succession.

Implications for Compliance Monitoring

Elliptic advised compliance teams that funds arriving from a liquidity pool should not be presumed clean, particularly when the pool involves a newly minted token and a limited set of trading wallets. Warning signs include tokens created only days earlier, pools dominated by a handful of addresses, wallets that exclusively buy or exclusively sell the token, and newly funded addresses that begin trading in round amounts shortly after receiving assets.

The firm continues to update a public blocklist of addresses linked to the Binance theft and recommends continuous re-screening of previously cleared deposits as new labels are applied. While the meme-token approach slows investigators, every step remains recorded on public ledgers, allowing the full path to be reconstructed once the intermediate pools are identified.