Source publication time: November 10, 2026, at 03:36:02 UTC+8.
Cartoon branding and rapid trading can make a newly minted token look like another speculative meme coin. In the cases described by blockchain analytics firm Elliptic, however, the tokens served a different purpose: moving stolen cryptocurrency through liquidity pools to obscure the direct connection between wallets.
According to Decrypt’s original report, Elliptic linked the activity to North Korean hackers laundering part of a reported record $6.4 billion stolen from Binance. The research, credited to Elliptic co-founder Tom Robinson, described activity on Tron and Near, with a close variant on Solana.
Familiar branding, disposable tokens
The clearest example involved at least six tokens created on Near between November 5 and 7, 2026. Each had its own liquidity pool pairing the new token with NEAR.
Their imagery borrowed familiar meme-coin conventions: a bow-wearing monkey, a flag-draped duck, a chimpanzee and a fox. One used an “Elon 2028 President” image of Elon Musk, who had no connection to the tokens. Names included FUK and SINU.
Creating each token cost about 25 NEAR, roughly $90. According to the report, all six followed the same pattern: launch, heavy trading within hours using stolen NEAR, and abandonment. The remaining liquidity was withdrawn on November 8.
About 117,000 NEAR, worth roughly $430,000, passed through the six tokens. Much of that subsequently moved into stablecoins or a cross-chain bridge. In this account, the trading activity was part of a laundering operation—not evidence of independent demand for the tokens.
What the liquidity pool changed—and what it did not
Elliptic described a process in which launderers created a token and paired it with an established asset, such as NEAR or a stablecoin. One set of wallets used stolen funds to buy the token; another sold it through the pool and collected the proceeds.
The pool acted as an intermediary. Rather than receiving stolen assets directly from the buying wallets, the collecting wallets appeared to be traders cashing out a meme coin.
That separation did not make the funds untraceable. Elliptic stressed that the trail remained fully visible onchain. The maneuver instead slowed investigators, giving launderers additional time to move funds before wallets or assets were flagged.
A small layer in a much larger operation
The roughly $430,000 routed through the six Near tokens represented only a small portion of the reported Binance theft. Elliptic had previously found that more than $3 billion of the stolen cryptocurrency remained unlaundered and that the operators were creating a new wallet approximately every 25 seconds.
The firm first observed this meme-token tactic in 2025 while tracing the $1.5 billion Bybit theft. That theft was also attributed to TraderTraitor, the group identified as responsible for the Binance breach.
Elliptic’s warning to compliance teams was specific: funds arriving from a liquidity pool should not automatically be treated as clean, particularly when newly created tokens and a small group of trading wallets are involved. In these documented examples, familiar meme branding and high turnover provided cover for fund movement, not proof of a functioning community or genuine market interest.