Elliptic Traces $430,000 in Stolen Binance Funds Through NEAR

By Elena Vasquez

About 117,000 units of NEAR stolen in the Binance hack, worth roughly $430,000 at current prices, moved through six meme-coin liquidity pools on the NEAR Protocol blockchain, according to Elliptic.

Elliptic linked the operation to North Korean actors. The disclosed account identifies no arrest, charge, asset seizure or fund return, while the $430,000 figure represents token value at a current-price snapshot rather than a final recovery amount.

How did the stolen NEAR move?

The six tokens—FUK, OLCCL, MEILI, MMLI, DABI and SINU—launched between Nov. 5 and Nov. 7. Each token had its own liquidity pool paired with NEAR, creating six parallel venues for the stolen assets to circulate.

The traced flow averages roughly 19,500 NEAR per pool, although the source does not show whether the amounts were evenly distributed. That average describes the overall route rather than an individual pool balance.

Wallets funded with stolen NEAR bought those tokens through the pools. A separate group then sold the tokens for NEAR, avoiding a direct transfer between the two wallet groups.

The structure inserted multiple swaps between the funding and sale stages. Those swaps made the route harder to follow but left the transactions visible onchain, according to Elliptic.

Takeaway: The operation added steps to the money trail without removing its public record.

Did the new tokens attract outside demand?

Wallets involved in the operation drove nearly all trading in the tokens, leaving little outside demand. Token creation and apparent pool activity alone therefore did not demonstrate broad adoption.

The concentration also limits what investors and investigators can infer from market activity. The source provides no pool balances, individual token values, wallet addresses, transaction hashes or precise allocation of the 117,000 NEAR among the pools.

Takeaway: The tokens primarily served as routing instruments for stolen funds, not evidence of an established retail market.

Where else has Elliptic seen this method?

Elliptic reported similar methods on Tron. On Solana, a related route used existing tokens rather than the six newly launched tokens described on NEAR, indicating that the technique was not confined to one chain or one launch pattern.

Elliptic said it first observed the token-and-pool method after the 2025 Bybit hack. The Binance activity adds to its earlier tracing of hack funds across 12,000 wallets; the source does not equate that wider wallet count with the six-pool operation.

Takeaway: Cross-chain tracing now requires examining token creation, pool funding and withdrawal behavior, not only direct wallet transfers.

What should compliance teams examine?

Elliptic advised compliance teams to examine “what enters a liquidity pool before treating funds withdrawn from it as clean.” A withdrawal can resemble a fresh wallet receipt even when the pool contains assets that passed through several trades.

The warning does not establish that every withdrawal from a liquidity pool is illicit. It identifies a specific risk marker—use of a newly created or suspect pool followed by withdrawals—and makes upstream transaction review necessary before a receiving wallet receives a clean designation.

Takeaway: Compliance cannot treat the receiving wallet as the beginning of the asset’s history.

What remains unresolved?

Elliptic’s attribution provides a named analytical source, but the disclosed findings do not show the transactions or evidence behind the North Korean link. They also omit the year of the Nov. 5-7 launches and the price timestamp behind the $430,000 estimate.

Those omissions do not change the onchain sequence Elliptic describes. They do mean that the valuation remains an estimate tied to cited prices, while the attribution should be read as an analytical finding rather than a stated legal conclusion.

Takeaway: The tracing is operationally specific, but the disclosed evidence leaves attribution and valuation questions open.

For compliance teams, the next practical test is whether they can identify fund entry into each pool before pooled assets leave it; otherwise, each additional swap will lengthen investigations without making the transfers invisible.