Hackers Used NEAR Memecoins to Wash Slice of $6.3 Billion Binance Haul

How the tactic worked

Days after crypto's biggest heist, the attackers launched six NEAR-based tokens - FUK, OLCCL, MEILI, MMLI, DABI and SINU - that traded heavily for a few hours and were then abandoned, according to Elliptic. They used stolen NEAR to buy the memecoins on decentralized exchanges, ending up with the stolen NEAR in wallets that were not linked to the original theft. About $430,000 was moved this way, but roughly $44 million worth of the stolen NEAR has not been touched.

The aim was cover, not a pump and dump. The tokens leaned into meme visuals: one logo showed a monkey with a pink bow, another featured Elon Musk under "Elon 2028 President," and Elliptic said there is no suggestion Musk has any connection.

The scale and speed

Elliptic described a largely automated operation. In a Nov. 7 post, the firm counted more than 20,000 wallets and at least 65,000 transactions within a week - roughly one new wallet every 30 seconds and one transaction every 10 seconds. The funds have also hopped through thousands of wallets and across multiple blockchains, and Chainalysis has pointed to Chinese money laundering networks as playing a role in converting the haul to cash.

Elliptic said that about $3.13 billion is still parked in addresses linked to the hack, with the bulk in Bitcoin and Ether. The attackers appear to have funneled funds into those coins since their issuers lack the power to freeze them, extending the time available to launder. The group used privacy focused decentralized tools including THORChain, Privacy Cash and Wasabi Wallet to execute trades.

Smart investors learn to use new tools to keep a thoughtful edge. We're hosting our first ever investor livestream on 11/17 to show you how to use ChatGPT and Claude to invest like a pro, hosted by Briefs Finance CEO Jaspreet Singh. Save your seat.

What has been frozen and who is blamed

U.S. authorities have attributed the Oct. 29 Binance theft to North Korea, pointing to the TraderTraitor group. Elliptic noted that this memecoin laundering playbook first showed up after another breach last year, when at least $24 million stolen from the Bybit exchange was washed through memecoins by suspected North Korean hackers.

The investing takeaway

Figures are as of Nov. 9, 2026. According to Elliptic, only a trivial share has probably been converted to cash, and some figures may fluctuate with price changes. Frozen refers to assets already locked by token issuers, whereas the rest of the tokens are still sitting in wallets associated with the hack.

The bottom line: large crypto heists now move at machine speed through short lived tokens and into assets that issuers cannot freeze, complicating tracing and recovery. That raises operational and counterparty risk around any crypto exposure in your portfolio.

Understanding how emerging technology reshapes markets helps investors make calmer, clearer choices. On 11/17, our CEO Jaspreet Singh goes live for our first ever investor livestream on how to use ChatGPT and Claude to invest like a pro. Register to join him.