North Korean Hackers Channel Binance Funds Through Fake Tokens Arabian Post

(MENAFN- The Arabian Post) clearfix"> North Korean-linked cryptocurrency launderers have channelled stolen Binance assets through newly created tokens and decentralised trading pools, disguising transfers as ordinary market transactions, blockchain analytics company Elliptic said on Monday.

The operation moved approximately 117,000 NEAR tokens, worth about $430,000, through six disposable meme coins created between 5 and 7 November. Elliptic identified the activity while tracing assets from the $6.43 billion theft at cryptocurrency exchange Binance on 29 October.

The findings show how attackers can exploit liquidity pools to separate wallets receiving stolen cryptocurrency from those collecting its proceeds. Rather than transferring assets directly between addresses, operators exchanged stolen NEAR for self-created tokens and then used different wallets to sell those tokens back into the same pools.

The receiving addresses consequently appeared to have obtained their holdings through token sales. Elliptic stressed that the transactions remained visible on public blockchains, meaning the technique complicated tracing rather than making the assets untraceable.

The Federal Bureau of Investigation attributed the Binance theft to North Korea's TraderTraitor operation on 31 October. The agency said more than $6 billion in virtual assets had been stolen and urged cryptocurrency businesses, blockchain operators and investigators to block transactions associated with identified attacker addresses.

Elliptic identified six NEAR-based tokens named FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each was paired with NEAR in a separate decentralised exchange liquidity pool. Creating an individual token cost approximately 25 NEAR, equivalent to around $90, making repeated deployment inexpensive.

Investigators found that wallets associated with the laundering network conducted every sale across the six tokens and virtually all purchases. Limited outside purchases of FUK represented less than 1% of its trading volume. Three tokens each had just one buying wallet and one selling wallet.

See also AI features in 84% of surveyed ransomware incidents

The trading patterns reinforced Elliptic's assessment that the tokens were created for laundering rather than genuine market demand. Every token began selling within three hours of creation, while at least three-quarters of each token's activity occurred within a single day.

Five token creators received funding from wallets involved in selling an earlier token between two and 13 minutes before the next launch. That sequence linked successive launches and showed how proceeds from one trading cycle helped finance another.

By 8 November, trading had stopped across all six tokens. The creators of four withdrew remaining liquidity from their pools that afternoon. Approximately the same quantity of NEAR that entered the buying wallets subsequently left collecting wallets, with much converted into stablecoins or transferred towards cross-chain bridges.

Elliptic said the software used to create the tokens, the exchange and the wallet application had not themselves acted improperly. The laundering scheme instead exploited standard functions available to ordinary users of decentralised financial services.

The company also detected a comparable method on the Tron blockchain on 2 November. On Solana the following day, stolen assets were exchanged for existing thinly traded or wrapped tokens before being converted into USDC and moved across blockchains. Unlike the NEAR activity, that variation did not depend on newly manufactured tokens.

Elliptic previously identified the homemade-token technique during laundering following the 2025 Bybit theft, when at least $24 million passed through a token paired with a stablecoin on Tron. The FBI has linked both exchange thefts to TraderTraitor.

The wider Binance laundering operation involved more than 20,000 wallets across 16 blockchains and at least 65,000 transactions by 9 November, Elliptic calculated. It estimated that approximately $3 billion remained in addresses associated with the theft, while $2.85 billion of the stolen assets had been frozen or seized.

See also UK and allies expose China-linked cyber intrusion methods

Separately, Elliptic tracked 7,000 ETH, worth $15 million, entering Tornado Cash by 9 November. It also identified bitcoin transactions using coinjoin arrangements, a method making histories harder to follow. These movements formed part of the broader effort to redistribute the stolen holdings.

The company said about 11.8 million stolen NEAR, valued at $43.7 million, had not moved. It advised compliance teams to examine the origins of assets entering liquidity pools rather than assuming that proceeds from decentralised swaps were legitimate.

Indicators identified by Elliptic included newly issued tokens, pools dominated by a handful of wallets, separate addresses exclusively buying or selling, and accounts funded shortly before trading. Its analysis found that some of the six tokens used cartoon animal imagery, while another displayed an image of Elon Musk, who was not implicated in the activity.

MENAFN10112026000152002308ID1111939966