The hackers responsible for the Binance hack are using their own memecoins to launder part of the stolen cryptocurrencies. According to Elliptic, six tokens launched on NEAR between November 5 and 7 allowed approximately $430,000 to be transferred. Crypto transactions remain visible on the blockchain, but their tracing is becoming more complex.
In brief
- Six memecoins were created on NEAR between November 5 and 7, 2026.
- Around 117,000 NEAR, or $430,000, passed through these tokens.
- Each creation cost around 25 NEAR, or $90.
- Crypto hackers use liquidity pools to obfuscate transfers between wallets.
- This method slows down investigators without making transactions invisible.
Binance hack: six memecoins created on NEAR
On October 29, 2026, hackers emptied Binance hot wallets. The crypto exchange evaluates the impact at approximately $6.3 billion. On October 31, the FBI attributed the theft to TraderTraitor, a group linked to North Korea. Pyongyang rejects the accusation.
In a report published on November 9Elliptic describes this tactic. Six tokens were created on NEAR in three days. Their visuals notably represent a monkey, a duck or an “Elon 2028” poster, with no established link with Elon Musk. Each creation cost around 25 NEAR, or $90.
In total, nearly 117,000 NEAR passed through these memecoins. That’s almost $430,000. Elliptic a also spotted a comparable token on Tron as well as a variant on Solana.
How are memecoins used for crypto laundering?
A laundering memecoin is a token used to pass stolen crypto funds through a liquidity pool. This mechanism adds a step between the wallet which provides the funds and the one which recovers the asset.
Concretely, the launderer associates his token with an asset, such as NEAR, in a pool of a decentralized crypto platform (DEX).
- A first group of wallets buys the memecoin with the stolen funds.
- A second group resells the tokens and recovers the matched asset.
According to Elliptic, crypto wallets linked to the network made all sales of the six tokens and all purchases of five of them. None of the six memecoins were traded, however. since November 8.
Five creators had been funded by a wallet that had sold a previous token, two to thirteen minutes previously. Every memecoin was sold within three hours following its creation, according to Elliptic.
$430,000: less than 0.01% of the loot
The $430,000 represents less than 0.01% of the 6.3 billion stolenaccording to the calculation of Gizmodo. Elliptic also insists on one point: each step remains visible on the crypto blockchain. In other words, the technique does not hide funds. It wastes the time of those who follow them.
A similar technique was even used after the hack of Bybit in February 2025. At least 24 million dollars then passed through a token created on Tron.
Memecoins therefore constitute only part of the laundering. As of November 9, Elliptic recorded more than 20,000 crypto wallets, 16 blockchains and at least 36 services involved. Its follow-up estimated:
- approximately $3 billion in funds still in addresses linked to the theft;
- 2.85 billion frozen assets.
These categories are separate and should not be added together as recovered crypto funds.
Elliptic also rates approximately $29 million ETH passed through THORChain to bitcoin until the evening of November 4. The company expects a gradual conversion to bitcoin and then withdrawals through over-the-counter brokers over several months.
Certainly, memecoins weigh little compared to Binance’s total loot. They nevertheless illustrate multi-step laundering, where the transparency of the crypto blockchain does not guarantee the immediate identification of beneficiaries. It remains to be seen whether the unlaundered billions will follow the same route.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
