Binance Hack Proceeds Laundered Through Six NEAR Memecoins
Key Summary
Blockchain intelligence firm Elliptic reported that North Korean threat actors laundered $430K in stolen Binance exploit proceeds by routing capital through six newly minted NEAR memecoins. The exploit syndicate recycled a laundering blueprint previously deployed during the $24M Bybit hack on the Tron network.
Key Bullets
- Elliptic identified 117,000 NEAR tokens worth $430K passing through six speculative assets between November 5th and 7th.
- The laundering scheme utilized decentralized exchange liquidity pools to break direct transaction trails between compromised exchange addresses.
- Federal Bureau of Investigation dockets attribute the underlying exchange breach directly to North Korea-linked state-sponsored cyber actors.
- On-chain analysis confirmed the identical methodology mirrors the $24.00M Tron-based token laundering tactic observed during the 2025 Bybit exploit.
Elliptic Tracks $430K Through DEX Pools
Elliptic analysts revealed that hackers tied to the Binance breach funneled 117,000 NEAR tokens through six speculative tokens between November 5th and 7th. Public blockchain records show each token cost approximately 25 NEAR or $90 to deploy. The stolen capital passed through asset pairs including FUK, OLCCL, MEILI, MMLI, DABI, and SINU before being drained from liquidity pools.
The syndicate created the assets using standard token-launch portals. They paired the newly generated coins with legitimate assets on DEX venues. Wallet addresses linked to the exploit bought the assets, while a secondary cluster of addresses sold them back into the same pools.
Bybit Laundering Playbook Repeats On NEAR
Blockchain telemetry indicates this obfuscation technique mirrors the 2025 Bybit exploit. During that incident, bad actors moved $24.00M through a worthless Tron-based token. Security researchers verified that state-sponsored hacking collectives are scaling this evasion tactic across TRON, Solana, and NEAR.
DEX order books prevent direct wallet-to-wallet tracing by interposing automated liquidity pools between illicit source addresses and clean withdrawal destinations.
FBI Attributes Heist To TraderTraitor
Federal Bureau of Investigation incident reports tie the initial Binance breach to TraderTraitor. Compliance officers reviewed on-chain movement logs as investigators monitor secondary liquidity drains across automated market makers.
The $6.4B Binance Hack And CrossChain Tracing Hurdles
This latest milestone builds upon roots established on November 8, 2026, when blockchain intelligence firm Elliptic reported that $124.00M of assets stolen in the October Binance breach had already been converted into Bitcoin across thousands of wallets. While investigators tracked roughly 1,650 BTC held in newly generated addresses following cross-chain swaps involving stolen XRP and Solana tokens, compliance systems confirmed that approximately $2.85B of the original stolen capital was frozen. Meanwhile, another $3.11B remained isolated within tagged illicit addresses, illustrating the enduring cross-network transfer paths exploited by state-sponsored hacking collectives.
Impact score:4 out of 5 | Narrative Tracker:Security, Exploits & Asset Recovery
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.