North Korean Hackers Used NEAR Memecoins to Launder $430K

North Korean hackers created six tokens on the NEAR blockchain to launder about $430,000 in cryptocurrency stolen in the $6.3 billion Binance hack, according to blockchain analytics firm Elliptic.

The hackers launched the tokens between Nov. 5 and Nov. 7 and used liquidity pools on decentralized exchanges to move funds between wallets. The tokens attracted almost no outside trading and were abandoned soon after their launch.

One group of wallets swapped stolen NEAR tokens for the new memecoins. Another group then sold the memecoins back into the liquidity pools for NEAR. The process avoided direct transfers between the wallets involved, but all transactions remained visible on the NEAR blockchain.

Elliptic found that the creators of five tokens received funding from earlier token sales between two and 13 minutes before launching the next token. The timing connected the tokens through a sequence of transactions, the firm reported.

“North Korea’s launderers rarely rely on a single technique,” Elliptic co-founder Tom Robinson wrote in the report. “Instead, they layer many cheap techniques, each adding a little more delay.”

Elliptic reported that the same laundering method was used after the $1.5 billion Bybit hack in 2025. North Korean-linked actors moved at least $24 million through a newly created token on the TRON blockchain during that operation.

At the time of Elliptic’s analysis, about 11.8 million stolen NEAR tokens remained unmoved. Elliptic valued them at $43.7 million.

Reviewed and fact-checked by Alex Panasenko on November 10.