Hacker Laundered $430,000 Via Self-Minted NEAR Meme Coins: Elliptic

A hacker connected to a Binance-related breach moved $430,000 in stolen funds through six meme coins deployed on the NEAR blockchain, according to blockchain analytics firm Elliptic. The transfers unfolded over just three days, and every token in the chain was issued by the attacker directly.

Elliptic, which disclosed the activity in a report dated Nov. 9, said the meme coins used in the transfers were created by the hacker. That detail is the crux of the finding: this was not a case of an attacker trading proceeds through existing speculative assets. The attacker constructed the laundering instruments from scratch.

What does the technique change for compliance teams?

The method matters because it inverts a core assumption in transaction monitoring. Conventional screening logic traces funds across known venues — mixers, cross-chain bridges, high-risk exchanges — and flags patterns accordingly. Here, the attacker controlled the token contracts themselves, which means the tokens had no history, no prior risk score, and no counterparty footprint before the funds arrived.

Six tokens, deployed on one chain, moving $430,000 inside seventy-two hours describes a deliberately compressed pipeline. To put the figure in perspective, $430,000 is a modest sum by the standards of major exchange breaches, but the operational template scales. The constraint on this technique is not capital; it is the cost of deploying contracts and the speed of analytic coverage.

Why NEAR meme coins?

Elliptic's finding points to the structural feature that makes low-friction token issuance attractive to launderers. On chains where anyone can mint a fungible token in minutes, an attacker can generate fresh, clean-looking instruments at will. Each self-issued meme coin functions as a one-time conduit: funds enter, the token changes hands, and the trail thins with every hop through an asset that never existed before the theft.

For exchanges and analytics vendors, the implication is that token-age screening becomes a first-order signal. A wallet receiving a token created days earlier, with no liquidity history and no organic holder base, warrants friction before it warrants settlement.

What does this change for practitioners?

The practical question is how monitoring adapts. Elliptic's attribution demonstrates that chain analytics can still connect the endpoints — the firm identified the flow, quantified it at $430,000, and tied it to a Binance-linked attacker. Detection worked. What the case exposes is the gap between detection speed and deployment speed: an attacker can mint a new conduit in minutes, while investigative confirmation takes days.

Institutions processing NEAR-based token flows, particularly from recently deployed contracts, should expect heightened scrutiny of exactly this pattern. The Binance linkage also means the downstream exposure sits with any venue that accepted the meme coins or their proceeds without recognizing the mint-and-move sequence.

Expect analytics firms to weight self-issued token creation as a risk indicator going forward, and expect exchanges to tighten listing and deposit controls around tokens with no verifiable origin — before the next six-coin pipeline moves more than $430,000.