Elliptic says North Korea-linked hackers behind the Binance theft used self-issued meme coins to move stolen funds through decentralized trading pools. The method starts with a worthless token paired against a real asset. The attackers then trade in and out, so the funds pass through swaps instead of moving directly from a theft-linked wallet to the final destination.
Elliptic identified about 117,000 NEAR, worth roughly $430,000, routed through these tokens. Similar activity appeared on TRON, with a related pattern on Solana. The timing and trade sizes are part of the evidence: tokens were first sold within 3 hours of launch, at least three quarters of their trading happened in 1 day, and the amount of stolen NEAR going in matched the amount coming back out.
That looks less like independent buyers setting a price and more like a transfer dressed up as market activity. The pool adds hops to the transaction trail, but it doesn’t establish that funds coming out are legitimate. Elliptic says compliance teams shouldn’t treat a liquidity pool as a clean break in the chain of custody.
The next checkpoint is whether exchanges and other firms tighten scrutiny of newly launched tokens and thin pools, where fabricated volume can disguise another handoff.