North Korean hackers used six meme coins to launder $430,000 in stolen NEAR, Elliptic says

North Korea-linked hackers have found a new use for meme coins: hiding stolen money in plain sight.

Blockchain analytics firm Elliptic said on November 9 that actors tied to the regime created six meme tokens on the NEAR blockchain. They used them to launder about $430,000 in stolen NEAR, part of the proceeds from the $6.4 billion Binance hack on October 29.

Six tokens, three days, one purpose

According to Elliptic, the tokens were minted between November 5 and November 7. They carry the tickers FUK, OLCCL, MEILI, MMLI, DABI and SINU.

Each token was tied to NEAR through specific liquidity pools on decentralized exchanges. A liquidity pool works like an automated currency booth: users deposit pairs of tokens, and anyone can trade one for the other at a price set by an algorithm instead of an order book.

Roughly 117,000 stolen NEAR, worth about $430,000, moved through these six tokens. Elliptic said the goal was to break the visible on-chain connection between the wallets where the funds came from and the wallets where they ended up.

Blockchains are public ledgers, so every transfer leaves a trail. Investigators usually follow stolen funds hop by hop from one wallet to the next. Routing value through freshly minted tokens and their pools adds extra steps that resemble ordinary speculation, which makes the trail harder to read.

A familiar playbook from the Bybit hack

The technique is not entirely new. Elliptic’s findings indicate a similar meme token strategy was documented during the 2025 Bybit hack, when $24 million was moved this way.

The broader Binance theft gives the NEAR episode its context. The October 29 hack resulted in losses of $6.4 billion. Estimates of how much has since been frozen or recovered range from nearly $2.8 billion to $3 billion.

What this means for exchanges, investors and regulators

For exchanges, the lesson is that tracing work cannot stop once stolen funds hit a decentralized exchange. Funds coming out of newly created token pools tied to wallets linked to a hack deserve closer scrutiny than they might normally get. Elliptic’s ability to connect these six tokens to the theft shows the trail can still be followed, though it takes more effort.

For investors, there is a practical risk worth noting. Tokens created as laundering tools have no purpose beyond moving money. Anyone who buys into a pool like this, mistaking it for a regular meme coin launch, could end up holding an asset tied to illicit activity, with whatever reputational and liquidity problems come along with that.

Still, the story cuts both ways. The same transparency that lets attackers dress up laundering as trading is what allowed Elliptic to spot it within days of the tokens being minted. The tokens appeared between November 5 and 7, and the findings were public by November 9.