North Korean hackers from the TraderTraitor group have begun laundering funds stolen from Binance using custom-made meme coins on the NEAR Protocol network.
Elliptic analysts uncovered a new scheme used by the cybercriminals behind the large-scale October 2026 hack of the Binance exchange:
-Meme tokens as mixers: The hackers created at least six meme coins (including FUK, OLCCL, MEILI, MMLI, DABI, and SINU), each costing around $90 to launch.
-Laundering mechanics: The stolen funds were poured into liquidity pools on decentralized exchanges, paired with the new tokens. The meme coins were then sold back for “clean” NEAR through other addresses. In the final stage, the crypto was converted into stablecoins.
-Masquerading as traders: The entire chain of transactions appeared as if ordinary users had simply made a lucky profit trading new shitcoins.
-Volumes: Around 117,000 NEAR ($421,000) passed through the scheme. Analysts have also recorded similar transactions on the Tron and Solana networks.
So far, the hackers have managed to “cycle” only a small portion of their haul. This method does not completely conceal transactions, but it significantly slows down blockchain investigators.
Elliptic analysts uncovered a new scheme used by the cybercriminals behind the large-scale October 2026 hack of the Binance exchange:
-Meme tokens as mixers: The hackers created at least six meme coins (including FUK, OLCCL, MEILI, MMLI, DABI, and SINU), each costing around $90 to launch.
-Laundering mechanics: The stolen funds were poured into liquidity pools on decentralized exchanges, paired with the new tokens. The meme coins were then sold back for “clean” NEAR through other addresses. In the final stage, the crypto was converted into stablecoins.
-Masquerading as traders: The entire chain of transactions appeared as if ordinary users had simply made a lucky profit trading new shitcoins.
-Volumes: Around 117,000 NEAR ($421,000) passed through the scheme. Analysts have also recorded similar transactions on the Tron and Solana networks.
So far, the hackers have managed to “cycle” only a small portion of their haul. This method does not completely conceal transactions, but it significantly slows down blockchain investigators.
