Elliptic Traces Fake Tokens in $6.4B Binance Hack Laundering

By Elena Vasquez

North Korean actors used six newly created tokens to move roughly $430,000 of stolen $NEAR through separate liquidity pools after the $6.4 billion Binance hack, according to blockchain analytics firm Elliptic. The six-token sequence ran from Nov. 5 through Nov. 7, while the surrounding tracing included Tron, Solana (SOL), USDC and cross-chain transfers.

Elliptic said it first identified the method while tracking funds stolen from Bybit in 2025. In that case, North Korean launderers created a worthless token on Tron and used it to move at least $24 million through a liquidity pool.

The firm said the same approach appeared again shortly after the Binance theft. Taken together, the evidence points to a repeatable laundering mechanism built around newly created tokens.

How did the token swaps obscure the stolen funds?

Attackers used one group of wallets to buy a newly created token with stolen funds. A separate group sold the tokens back into the liquidity pool and received the original cryptocurrency, placing the pool between the funding and receiving wallets. That arrangement complicates an immediate connection between incoming and outgoing funds, although it does not delete the underlying records.

On Nov. 2, Elliptic identified a newly created Tron token that appeared specifically for laundering. On Nov. 3, thieves exchanged stolen SOL for wrapped and thinly traded tokens before converting them into USDC and transferring the proceeds to other blockchains. The $NEAR activity supplied the clearest evidence and inserted another separation between thieves and recipients rather than the disappearance of the blockchain trail.

What did the six-token sequence show?

Between Nov. 5 and Nov. 7, attackers launched six tokens:

• FUK
• OLCCL
• MEILI
• MMLI
• DABI
• SINU

Each token was paired with $NEAR in its own liquidity pool. Creating a token cost about 25 $NEAR, or approximately $90. The six tokens moved around 117,000 $NEAR, worth roughly $430,000, after buyers funded their purchases with stolen $NEAR.

Almost the same amount later emerged through separate wallets, and much of it became stablecoins or moved through a cross-chain bridge. Elliptic found that wallets linked to the operation handled almost all buying and selling, rather than regular investors. DABI, MMLI and SINU each had only one buying wallet and one selling wallet.

All six tokens traded heavily shortly after launch and then were abandoned, with no further activity recorded after Nov. 8. Proceeds from earlier tokens funded newer launches, connecting the six-token operation. The pattern was concentrated, short-lived and controlled by linked wallets rather than ordinary investors.

Can investigators still follow the money?

The method does not erase the blockchain trail. Investigators can still follow the funds, but additional swaps, wallets and bridge transfers make the process more time-consuming. Elliptic estimates that around 11.8 million $NEAR, worth approximately $43.7 million, remains unmoved.

The $430,000 routed through the six tokens represents only a small portion of the stolen funds. At roughly $90 per launch, attackers can afford to repeat the method with different tokens. The low creation cost adds hops without removing the evidentiary trail.

What should exchanges and compliance teams do?

Elliptic warned exchanges and compliance teams not to automatically treat funds received from liquidity pools as legitimate. The firm identified three signals that could indicate laundering:

• Newly created tokens
• Pools with very few participating wallets
• Accounts funded shortly before trading

These signals do not establish wrongdoing by themselves, but they can expose a gap between the apparent legitimacy of pool receipts and the origin of the funds. In practical terms, compliance teams cannot treat a pool receipt as proof that the money is clean.

No enforcement action or timetable accompanied the findings. The market-structure change to watch is whether exchanges tighten controls on pool-funded accounts before the remaining $43.7 million moves.