Blockchain analytics firm Elliptic reported that North Korean-linked launderers created six meme coins on the NEAR blockchain to move funds stolen from the recent Binance hack. Each token was launched for about $90 and served as a tool for disguising the origins of the cryptocurrency.
Methods used to hide transactions
Elliptic identified that the six tokens—named FUK, OLCCL, MEILI, MMLI, DABI, and SINU—were set up using a public token creation tool at a cost of roughly 25 NEAR per coin. The tokens were decorated with cartoon-style artwork, including images like a monkey with a pink bow and a duck in front of the American flag. One token featured Elon Musk beneath a banner reading “Elon 2028 President,” though Elliptic confirmed there is no connection between Musk and these coins.
The launderers paired each of the six tokens with NEAR in separate liquidity pools on decentralized exchanges. Liquidity pools act as containers for two different assets that facilitate peer-to-peer trading without intermediaries.
A coordinated set of wallets used the stolen NEAR tokens to buy the newly created meme coins from the pools. A second group of wallets then sold the same tokens back into the pools, effectively extracting NEAR while making the transaction chain more difficult to trace. The structure ensured no direct transactions linked the two groups of wallets.
Mini dictionary: Liquidity pool—A mechanism on decentralized exchanges that enables users to trade between two assets directly by providing liquidity, removing the need for a traditional order book.
Between November 5 and November 7, approximately 117,000 NEAR—valued at about $430,000—was moved through these meme coins.
Elliptic stated that “they exist only to put a pool between the stolen funds and the next wallet,” and that trading data confirmed the wallets controlled essentially all transaction activity for these tokens.
The report indicated almost every buy and sell order in all six tokens came from the laundering wallets themselves, aside from a small burst of FUK purchases on launch day, which represented a tiny fraction of trading volume.
| Token Name | Launch Cost (NEAR) | Date Active |
|---|---|---|
| FUK | 25 | Nov 5–8 |
| OLCCL | 25 | Nov 5–8 |
| MEILI | 25 | Nov 5–8 |
| MMLI | 25 | Nov 5–8 |
| DABI | 25 | Nov 5–8 |
| SINU | 25 | Nov 5–8 |
Tactics and broader laundering trends
Elliptic traced the origin of this obfuscation strategy to cases such as the Bybit hack in 2025, where launderers deployed nearly worthless Tron-based tokens to obscure the flow of funds. The pattern resurfaced in the Binance case, with similar tokens observed for both Tron and Solana. The FBI has attributed the Binance attack to North Korea’s TraderTraitor hacking group.
In the Binance theft, the NEAR-based laundering method accounted for less than 0.01% of the roughly $6.3 billion stolen. Elliptic observed that about 3,000 bitcoin from the attack, worth roughly $225 million, had already been moved to new bitcoin addresses. Meanwhile, 11.8 million NEAR, valued at $43.7 million, remained unmoved.
Elliptic co-founder Tom Robinson wrote that these techniques act as a delay tactic for investigators, stating that North Korea’s launderers “layer many cheap techniques, each adding a little more delay.”
Jonty, founder of Pangolin Intelligence, commented on Unchained that such networks move funds between wallets “to essentially evade the eyes of transaction monitoring software.”
Mini dictionary: Pangolin Intelligence—A blockchain analytics and tracing company that provides tools for asset tracking and anti-money laundering efforts.
Red flags for compliance teams
Elliptic cautioned compliance teams that liquidity pool funds should not automatically be treated as clean. Warning signs include brand new tokens, low trading activity, and pools dominated by wallets that exclusively buy or sell.
No trading activity has occurred in these six NEAR tokens since November 8. On the afternoon of that date, four token creators withdrew the remaining funds from their pools, and the assets have remained dormant since then.
