Throwaway Meme Coins Give Binance Hack Proceeds a Liquidity Pool Shield

The money involved is small, but the plumbing is what stands out. Launderers working for North Korea spun up six throwaway meme coins to pass funds stolen from Binance through liquidity pools, according to a Monday report from blockchain analytics firm Elliptic. Between Nov. 5 and Nov. 7, roughly 117,000 NEAR, about $430,000, moved through the six tokens.

Each token was paired with NEAR, the native coin of the NEAR Protocol blockchain, in its own liquidity pool. That's a two-asset pot on a decentralized exchange that anyone can trade against. One group of wallets paid stolen NEAR into the pool to create the token, and a second group sold the token back and withdrew NEAR. No transfer connects the two groups directly, because the pool sits in the middle. As Elliptic put it on X, "They exist only to put a pool between the stolen funds and the next wallet."

The tactic was less hidden than it looks. Days before the tokens appeared, Jonty, founder of Pangolin Intelligence, said that networks laundering for North Korea shuffle funds between wallets "to essentially evade the eyes of transaction monitoring software." He named Chainalysis, TRM Labs and Elliptic as the monitors in question.

Six Tokens, One Chain of Wallets

The tokens, FUK, OLCCL, MEILI, MMLI, DABI and SINU, carried cartoonish meme-coin artwork. One showed a monkey in a pink bow, another a duck posed against an American flag, and a third put Elon Musk beneath an "Elon 2028 President" banner. Elliptic said there is no suggestion Musk has any link to them. Each token cost about 25 NEAR, or around $90, to launch.

The trading data suggests the tokens had no purpose beyond laundering. Outside traders were almost entirely absent. The laundering wallets placed every sell order across all six tokens and every purchase in five of them. The exception was a handful of FUK buys on launch day, a sliver of that token's activity.

The tokens were also linked in a chain. In five cases, the wallet that funded a new token's creator had dumped the previous token just 2 to 13 minutes before launch, so profits from one bankrolled the next. None of the six has traded since Nov. 8. That afternoon, four of the creators pulled out the funds still sitting in their pools.

A Tactic First Seen With Bybit

This isn't a new trick. Elliptic says it first saw the pattern after Bybit lost $1.5 billion in 2025, when launderers used a worthless Tron token to move at least $24 million. In the Binance case, a similar Tron token appeared on Nov. 2. A day later, stolen SOL, Solana's native token, moved through existing thinly traded Solana tokens.

The NEAR sums look modest next to the roughly $6.3 billion taken from Binance on Oct. 29, a theft the FBI attributed to North Korea's TraderTraitor hacking group. According to Elliptic, about 11.8 million NEAR, worth $43.7 million, from the hack hasn't moved yet. The firm warned that these tokens are cheap to run and could carry far larger amounts.

Every step stays visible onchain, which is the twist. "The technique slows investigators down rather than hiding the funds," Elliptic's Tom Robinson wrote in the report. The firm told compliance teams not to treat funds leaving a liquidity pool as clean by default. Its warning signs include tokens only days old, pools with a handful of traders, and wallets that only buy or only sell.

My read: the pool step is designed to make a single transfer look like a dead end, and it only works on teams that stop at the first hop. Compliance desks that screen the pool exit as carefully as the original deposit will catch what this approach depends on them missing.