Liquidity pools can obscure the immediate relationship between wallets without erasing the trail of stolen assets, according to Elliptic research reported by Decrypt on November 10, 2026. The blockchain analytics firm said North Korean hackers used self-created meme coins to launder a portion of the reported $6.4 billion stolen from Binance.
For exchanges and other firms screening incoming deposits, the distinction matters: assets arriving from a decentralized exchange’s liquidity pool should not be presumed clean simply because they did not arrive directly from a thief’s wallet.
How the funds moved
According to Elliptic’s research, credited to co-founder Tom Robinson, the launderers created tokens with no underlying value and paired them with assets such as NEAR or stablecoins in liquidity pools.
One set of wallets used stolen funds to buy the newly minted tokens. A separate set then sold those tokens into the pools, withdrawing assets that appeared to be proceeds from ordinary trading. The pool acted as an intermediary, avoiding a direct transfer between the buying wallets and those collecting the proceeds.
Elliptic said it observed the technique on Tron and Near, with a close variant on Solana. The firm stressed that the transactions remained fully traceable on-chain: the extra steps slowed investigators rather than making the money untraceable.
Six Near tokens processed roughly $430,000
The clearest example described in the report involved at least six tokens created on Near between November 5 and 7, each with its own NEAR liquidity pool. Creating each token cost about 25 NEAR, approximately $90.
The tokens used familiar meme-coin imagery, including cartoon animals and an “Elon 2028 President” image. Elon Musk had no connection to the tokens. Names included FUK and SINU.
Elliptic said all six followed a similar pattern: launch, heavy trading within hours using stolen NEAR, and abandonment. The remaining liquidity was withdrawn on November 8.
About 117,000 NEAR—roughly $430,000—passed through the six tokens. Much of that value subsequently moved into stablecoins or a cross-chain bridge.
A tracing obstacle, not a clean bill of funds
The amount routed through these pools was a small portion of the reported theft. Elliptic had earlier found that more than $3 billion of the stolen crypto had yet to be laundered, and that the operators were creating a new wallet roughly every 25 seconds.
The firm first observed the meme-token technique the previous year while tracing the $1.5 billion Bybit theft. That attack was also attributed to TraderTraitor, the group identified as responsible for the Binance breach.
Elliptic’s warning for compliance teams was specific: liquidity-pool provenance alone does not establish that funds are clean, particularly when newly created tokens and a small group of trading wallets are involved.
Original publication: November 10, 2026, at 03:36:02 UTC+08:00. Read the original Decrypt article.