Blockchain analytics firm Elliptic has identified a new tactic used by North Korean-affiliated crypto launderers, who have reportedly turned to minting their own disposable meme coins to wash stolen funds. According to Elliptic’s latest report, this approach was used to process approximately 117,000 NEAR, around $430,000, over just three days between November 5 and November 7.
Laundering strategy and token details
Elliptic outlined the mechanics of the operation: the launderers created six different tokens, each paired with NEAR in a liquidity pool on decentralized exchanges. The process unfolded with one group of wallets depositing NEAR stolen from Binance into a liquidity pool to obtain the new tokens, followed by another group selling those tokens back and retrieving NEAR. Because the pool acts as an intermediary, no direct link forms between the two groups, complicating efforts to track stolen assets across wallets.
Elliptic emphasized,
The meme coins exist only to place a pool between the stolen funds and the next wallet, effectively slowing tracking attempts.
The six tokens involved—FUK, OLCCL, MEILI, MMLI, DABI, and SINU—featured typical meme coin aesthetics, ranging from a monkey with a pink bow to a duck positioned before an American flag and even a depiction of Elon Musk under an “Elon 2028 President” banner. Elliptic clarified that Musk has no association with the coins. Each of the tokens cost about 25 NEAR, or roughly $90, to launch.
Trading activity showed minimal outside participation, with laundering wallets executing all sell orders in every token and all buy orders in five of them. An exception was a small number of external buys in FUK on its launch day. Elliptic’s investigation also revealed that the creation of each new token was linked to the rapid liquidation of the previous one, with a chain of wallets dumping old tokens and funding new ones within minutes.
Connections to larger hacks and compliance guidance
The technique echoes earlier laundering efforts. Elliptic noted similar schemes following the Bybit hack in 2025, where launderers used worthless Tron-based tokens to move at least $24 million. More recently, after the Binance theft on October 29, which the FBI attributed to North Korea’s TraderTraitor hacking group, Elliptic observed related activity with Tron and Solana tokens. Despite the highlighted NEAR transactions representing a small fraction, about 11.8 million NEAR, valued at $43.7 million, remains unmoved from the Binance incident. Elliptic warned that given the low cost of creating new tokens, much larger sums could potentially be processed using this method.
Tom Robinson of Elliptic stated,
Although these steps are visible on the blockchain, the method is designed to delay investigations rather than fully conceal the funds.
Elliptic advised compliance teams to exercise caution and not automatically consider assets emerging from liquidity pools as “clean.” The firm recommended monitoring for red flags, such as tokens only a few days old, pools with limited trading activity, and wallets engaged solely in buying or selling.
Given the rapid launch and turnover of new tokens within the NEAR ecosystem, traders and compliance professionals require tools that enable timely detection of unusual trading patterns and asset flows. CryptoAppsy’s live news monitoring feature helps users stay updated on emerging security threats and illicit activity patterns, while its smart price alerts can notify compliance teams or investors when rapid token movements or pool deposits signal potential risks linked to suspicious transactions.
