Elliptic, a blockchain analytics firm, has unearthed a sophisticated method employed by the North Korean-linked TraderTraitor group to funnel stolen Binance funds through newly minted meme tokens. Primarily utilizing the NEAR and Tron networks, this strategy has also made appearances on the Solana blockchain.
Creation of Six Tokens on NEAR
Between November 5 and 7, 2026, the group launched at least six tokens on the NEAR protocol, identified as FUK, OLCCL, MEILI, MMLI, DABI, and SINU. According to Elliptic, these tokens each cost approximately 25 NEAR, translating to around $90 per token. Recognized for its cost-effective transactions, NEAR provides an attractive platform for developers.
Elliptic noted, “Transferring funds before identification is a race against time, urging attackers to resort to methods that complicate traceability.”
The attackers paired each newly created token with NEAR in decentralized exchange liquidity pools. Wallets holding pilfered NEAR deposited assets into these pools in exchange for the new tokens. A secondary group of wallets then sold these tokens back into the pools, withdrawing NEAR in return. This scheme eliminated direct transfers between the wallets holding stolen assets and those making the purchases.
This structure portrayed buying wallets as regular traders capitalizing on ordinary market opportunities, though Elliptic highlighted that the technique effectively slowed down the process of tracking on-chain transactions.
Rapid Transaction Turnover
The tokens saw initial activity within three hours of their launch, with at least 75% of transactions completed within a day. Following November 8, the involved tokens ceased trading. Four creator wallets subsequently drained the remaining liquidity from the pools that same day.
In total, approximately 117,000 NEAR, equating to about $421,000, was moved using this method. Most of these funds were later directed into stable cryptocurrencies or through cross-chain bridges. Elliptic also observed that five of the six creator wallets received financing just before each token’s launch from a wallet selling previous tokens, indicating a self-sustaining operation.
Elliptic urged compliance teams to scrutinize funds sourced from liquidity pools containing newly created tokens.
Repeated Modus Operandi Noted
This tactic mirrors a 2025 incident following an attack on Bybit, where the same approach shifted at least $24 million on the Tron network. Back then, attackers combined worthless tokens with stable cryptocurrencies.
In the more recent Binance case, a similar token was flagged on Tron on November 2. The following day, stolen SOL assets were converted on the Solana network into low-volume existing tokens and traded for USDC.
Elliptic further reported that a minor portion of the stolen funds has been laundered via meme tokens thus far. Approximately 11.8 million NEAR, valued at around $42.4 million with NEAR priced at $3.60, remains unmoved.
