Disclaimer: The opinions expressed by our writers are their own and do not represent the views of U.Today. The financial and market information provided on U.Today is intended for informational purposes only. U.Today is not liable for any financial losses incurred while trading cryptocurrencies. Conduct your own research by contacting financial experts before making any investment decisions. We believe that all content is accurate as of the date of publication, but certain offers mentioned may no longer be available.

North Korea's TraderTraitor group has started laundering funds stolen from Binance through newly created meme tokens, according to Elliptic.

The $6.4 billion Binance hack took place in October 2026 and was attributed to TraderTraitor.

According to Elliptic, the hackers have used this technique on Tron and NEAR, while a similar approach has appeared on Solana.

Hackers launch six meme tokens on NEAR

Between Nov. 5 and 7, 2026, the hackers launched at least six of these tokens on NEAR: FUK, OLCCL, MEILI, MMLI, DABI and SINU. Launching one cost around 25 NEAR (about $90).

According to Elliptic, the hackers paired each token with NEAR in a liquidity pool on a decentralized exchange (DEX). Wallets holding stolen NEAR deposited it into the pool and received the new token. A second set of wallets then sold the token back into the pool and withdrew NEAR.

This way, the funds never move directly from the wallets holding stolen assets to the receiving wallets.

According to Elliptic, the receiving wallets look like ordinary traders who sold a token at a profit.

Each token got typical meme branding, from monkeys to an image of Elon Musk under an "Elon 2028 President" banner. Elliptic noted that Musk is not linked to the tokens.

Each token was sold for the first time less than three hours after launch, and at least 75% of its trading took place within one day. None of the six tokens has traded since Nov. 8, and the creators of four of them withdrew the remaining liquidity on that day.

In total, 117,000 NEAR (about $421,000) moved through the scheme. Most of it then went into stablecoins or to a cross-chain bridge.

Elliptic noted that five of the six token creators received funds from a wallet that had been selling the previous token 2 to 13 minutes before the new launch, and in this way the operation funded itself.

The only outside activity was a few small purchases of FUK on its first day, which accounted for less than 1% of its volume, Elliptic said.

Elliptic says technique slows down investigators

According to Elliptic, the on-chain trail stays public, and the technique makes tracing the funds slower. The hackers can also create many tokens and abandon each one after use.

In 2025, after the Bybit hack, the same scheme moved at least $24 million through Tron. In that case, the hackers paired a worthless token with a stablecoin.

In the Binance case, Elliptic identified a similar token on Tron on Nov. 2. On Nov. 3, stolen SOL was swapped into existing thinly traded tokens on Solana and then sold for USDC.

Elliptic said that so far only a small part of the stolen funds has gone through meme tokens. About 11.8 million NEAR from the theft has not moved yet, and at press time, NEAR is trading at $3.60, which puts these funds at around $42.4 million.

Elliptic also advises compliance teams to check funds coming from liquidity pools, especially pools with newly created tokens.

"Laundering is a race to move funds before they are flagged," Elliptic added.