Source published Nov. 10, 2026, at 03:36:02 UTC+8. The findings below reflect that reporting period.
Short-lived tokens, concentrated trading
Between Nov. 5 and 7, launderers created at least six tokens on Near and used their liquidity pools to move about 117,000 NEAR, worth roughly $430,000, according to Elliptic research reported by Decrypt. Elliptic linked the activity to North Korean hackers laundering part of the reported $6.4 billion stolen from Binance.
Each token was paired with NEAR in its own pool and cost about 25 NEAR—roughly $90—to create. The tokens saw heavy trading with stolen NEAR within hours of launch, then were abandoned. Remaining liquidity was withdrawn on Nov. 8. Much of the money subsequently moved into stablecoins or a cross-chain bridge.
The tokens used familiar meme-coin imagery, including cartoon animals and an “Elon 2028 President” image. Elon Musk had no connection to the tokens. Names included FUK and SINU.
How the pools separated the wallets
Elliptic’s research, credited to co-founder Tom Robinson, described a process in which launderers minted a token and paired it with an established asset, such as NEAR or a stablecoin. One set of wallets used stolen funds to buy the newly minted token; another set sold it into the pool to collect the paired asset.
The pool acted as an intermediary, avoiding a direct transfer of stolen funds between the buying and receiving wallets. The receiving wallets could therefore resemble ordinary traders exiting a meme coin.
Elliptic identified the tactic on Tron and Near, with a close variant on Solana. It first observed the method the previous year while tracing the $1.5 billion Bybit theft, also attributed to TraderTraitor, the group linked to the Binance breach.
Traceable funds, misleading appearances
The technique did not make the funds untraceable. Elliptic said the on-chain trail remained fully visible; the extra transactions instead slowed investigators and bought time before funds could be flagged.
The roughly $430,000 routed through the six Near tokens was a small portion of the reported theft. In earlier findings, Elliptic said more than $3 billion of the stolen crypto remained unlaundered and that the operators were creating a new wallet roughly every 25 seconds.
For compliance teams, Elliptic’s warning was that assets arriving from a liquidity pool should not automatically be treated as clean—particularly when newly minted tokens and a small group of trading wallets are involved. In these documented cases, heavy token trading reflected a laundering mechanism rather than evidence of independent market demand.