Elliptic Links 117,000 NEAR to Binance Theft Laundering

By Nathan Brooks

Elliptic linked roughly 117,000 NEAR from the Binance theft, worth about $430,000, to a North Korea-linked laundering operation using newly created tokens and exchange liquidity pools from Nov. 5 through Nov. 7, according to Elliptic’s review of on-chain records. The firm said the token-and-pool route left funds “traceable on-chain while adding steps that took more time to follow.”

The route centered on at least six newly created meme tokens: FUK, OLCCL, MEILI, MMLI, DABI and SINU. Operators paired each token with NEAR in a separate exchange liquidity pool. Elliptic estimated that creating each token cost about 25 NEAR, or $90, a modest setup expense beside the roughly $430,000 handled by the pools.

The six pools handled roughly $430,000 worth of NEAR. Recipient wallets then moved nearly the same amount onward, mostly into stablecoins or through cross-chain bridges. The transfers therefore did not end at the six pools; they continued through other destinations after passing through token and liquidity-pool legs.

No trades occurred in the six tokens from Nov. 8 onward. That afternoon, creators of four of them removed the liquidity still remaining in their pools. Stopping market activity and withdrawing liquidity did not reverse the earlier token creation, pool deposits or wallet transfers, all of which remained visible in public on-chain history.

Elliptic attributed the activity to North Korea-linked launderers and said the structure complicated tracing. It did not make the assets untraceable; the added steps increased the work required to follow them.

What does this change for investigators and exchanges?

For exchanges, compliance teams and blockchain investigators, the practical issue is the number of hops rather than simple transaction visibility. A direct NEAR transfer provides one transfer to follow. This route required reconstructing six token creations, six NEAR pairs, their liquidity pools and each subsequent move into stablecoins or across a blockchain bridge.

Each added leg requires investigators to reconcile wallet addresses, timing, pool balances and transaction outcomes. The method therefore raises the operational burden of attribution. It can slow the process of identifying where funds moved even though the underlying activity remains available for review on public ledgers.

The Nov. 8 liquidity withdrawals show why market activity and asset movement require separate analysis. The absence of trades did not erase earlier history, and removing liquidity did not cancel the transfers that came before it. The relevant evidence sat in the sequence of on-chain actions: creation, pairing, deposits, withdrawals and onward transfers.

As of Nov. 9, about 11.8 million NEAR from the Binance theft remained unmoved, worth roughly $43.7 million at the time. That unmoved balance was about 101 times the 117,000 NEAR associated with the six-pool episode. Put another way, the routed amount represented just under 1% of the larger balance.

The comparison narrows the episode’s immediate reach but does not remove its forensic significance. The named tokens provided investigators with a concrete sequence to test, and the six pools produced a defined set of records around each transfer. Reconstructing that sequence meant establishing how much NEAR entered each structure and how much left afterward.

For institutions that monitor flows, the workload rises with each additional instrument and destination. Analysts cannot rely on the token label or pool pairing alone; they still have to reconcile the underlying records.

Elliptic’s account does not show that the six tokens broke the on-chain link. It shows a deliberate increase in the number of steps between the theft and the next destinations.

The immediate watchpoint is the 11.8 million NEAR still unmoved: any future transfer through new token pairs, liquidity pools or bridges would extend the same multi-step compliance problem and require investigators to map every leg before identifying the final destination.