North Korean launderers spent three days last week minting and discarding their own meme coins on the NEAR blockchain to move funds from the Oct. 29 Binance theft, according to an Elliptic update. Six tokens — FUK, OLCCL, MEILI, MMLI, DABI and SINU — were created between Nov. 5 and 7 and used to pass roughly 117,000 NEAR, about $430,000, through the chain. The FBI has attributed the underlying Binance breach to the TraderTraitor group.
How the NEAR coins worked
Each token was made for about 25 NEAR, or roughly $90 — cheap enough to burn. The creators paired every one with NEAR in its own liquidity pool, bought with stolen NEAR, and then sold back through a second set of wallets. The trading was heavy for a few hours and then stopped. None of the six has traded since Nov. 8. On the afternoon of that day, the creators of four of the tokens pulled what liquidity was left.
The wallet trail shows it wasn't six independent projects. Five of the six creators were funded by a wallet that had just sold an earlier token, between two and 13 minutes before the next launch. It's a chain, not a portfolio.
Elliptic has seen this before
Elliptic first flagged the homemade-token method during the February 2025 Bybit theft, also blamed on TraderTraitor, when a worthless Tron token helped shift at least $24 million. In the Binance case, the firm says it has also seen the technique on Tron and a close variant on Solana — that one uses existing thinly traded tokens rather than freshly minted ones.
The scale of the tracing is larger than the six NEAR coins suggest. Elliptic says it has tracked more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions since the theft.
Where the rest of the money went
The bulk of the laundering has moved well past NEAR. Elliptic's update puts roughly 3,000 BTC — about $225 million — in new bitcoin addresses converted from other stolen assets. All of the stolen SOL has already been swapped, bridged or mixed, and much of the XRP route has fed into bitcoin. About 11.8 million NEAR, worth $43.7 million, still hasn't moved.
Binance has valued the theft at $6.34 billion and has reopened withdrawals in stages, saying it covered customer losses from its own funds. About $2.85 billion of the original haul has been frozen. Blockchain firms linked the breach to TraderTraitor within a day, though Binance has said the attack began with a fake job interview and ran for five months before any coins moved.
Small cash-out, long tail
For all the volume, Elliptic says a negligible amount of the stolen funds has likely been cashed out so far. The firm put North Korea's 2025 crypto haul above $2 billion, driven by the $1.46 billion Bybit exploit, with its cumulative known total above $6 billion even before Binance was hit.
The near-term question is whether the roughly 11.8 million NEAR sitting still becomes the next batch of throwaway tokens, or whether the launderers move it somewhere else entirely. Elliptic's wallet tracking hasn't shown a move yet.
