North Korean Hackers Flip Stolen Binance Funds Into NEAR Meme Coins
Key Summary
State-sponsored hacking collective TraderTraitor has begun laundering funds stolen from Binance by deploying meme tokens on the NEAR protocol, cycling 117,000 NEAR through DEX liquidity pools to obscure the transactional paper trail, according to blockchain analytics firm Elliptic.
Key Bullets
- North Korean hacking group TraderTraitor deployed six distinct meme tokens on the NEAR protocol between Nov. 5 and 7, 2026, to launder stolen Binance assets.
- Blockchain analytics firm Elliptic reported that the illicit operation cycled 117,000 NEAR valued at $421,000 through decentralized exchange liquidity pools.
- Hackers paired each newly created token with native NEAR on a DEX before selling the assets back to secondary wallets to obscure the transaction trail.
- Elliptic data confirms that roughly 11.8 million NEAR stolen from Binance remains stationary on-chain, valued at $42.4M with NEAR trading at $3.60.
TraderTraitor Deploys NEAR Meme Pools
North Korean state-sponsored hacking collective TraderTraitor deployed six distinct meme tokens on the NEAR protocol between Nov. 5 and 7, 2026, to obscure millions in stolen digital assets. According to blockchain analytics firm Elliptic, the illicit operation cycled 117,000 NEAR tokens through DEX liquidity pools. That volume equals roughly $421,000 based on prevailing market rates.
Deploying each token cost approximately 25 NEAR. That totals about $90 per contract launch. The hackers used thematic branding ranging from cartoon primates to political imagery. None of the six tokens have recorded any trading activity since Nov. 8.
Obfuscating Trails Via Automated Swaps
On-chain data compiled by Elliptic reveals that the cybercriminals paired each newly minted token with native NEAR inside DEX liquidity pools. Wallets holding stolen assets deposited tokens into the pool to receive the speculative assets. A secondary set of addresses then sold those tokens back into the pool to withdraw clean NEAR.
This mechanical loop prevents funds from moving directly between the source addresses and receiving wallets. Receiving addresses mimic ordinary traders cashing out profits. Operations funded themselves continuously because five of the six token creators received funding from wallets selling the preceding token minutes before launch.
Broader Laundering Frameworks Active
Elliptic flagged that the same criminal network utilized a parallel laundering playbook on Tron and Solana following the October 2026 Binance breach. In the 2025 Bybit hack, the syndicate pushed at least $24M through Tron by pairing worthless tokens with stablecoins. Compliance teams must now monitor liquidity pools hosting newly generated smart contracts.
Roughly 11.8 million NEAR stolen during the Binance exploit remains dormant in hacker-controlled addresses. At a spot price of $3.60, those unmoved holdings represent a valuation of $42.4M.
Impact score:4 out of 5 | Narrative Tracker:Security, Exploits & Asset Recovery
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.