Key Takeaways
- • Blockchain analytics firm Elliptic says North Korea is laundering cryptocurrency stolen from Binance through at least six homemade meme coins created on the NEAR blockchain between November 5 and 7, 2026.
- • About 117,000 NEAR, worth roughly $430,000 at the time of Elliptic's November 9 analysis, passed through the tokens.
- • The FBI attributed the October 29 theft of more than $6 billion in virtual assets from Binance to North Korea on October 31 and named the activity "TraderTraitor"; Pyongyang denies involvement.
- • Elliptic estimates total losses at $6.43 billion, the largest cryptocurrency theft ever according to the FBI, with roughly $225 million converted into bitcoin, $2.85 billion frozen or seized, and about $3 billion still sitting in theft-linked addresses.
Summary
Blockchain analytics firm Elliptic says North Korea is laundering cryptocurrency stolen from Binance through homemade meme coins, a scheme it describes as designed to resemble ordinary trading and slow down investigators. In its November 9 analysis, Elliptic said the launderers created at least six meme coins on the NEAR blockchain between November 5 and November 7. Roughly 117,000 NEAR, worth approximately $430,000 at the time of the analysis, passed through these tokens.
The FBI on October 31 attributed the theft of more than $6 billion in virtual assets from Binance, the world's largest cryptocurrency exchange, to North Korea. The bureau has identified the activity as "TraderTraitor." Pyongyang has denied being involved. The theft occurred on October 29 across 11 blockchains, and Elliptic estimates losses at $6.43 billion, which the FBI describes as the largest cryptocurrency theft on record.
According to Elliptic, the tokens have no apparent practical purpose beyond moving funds within the laundering network. The launderers set up exchange pools holding their tokens and NEAR wallets containing stolen NEAR, while other wallets in the network sold the same tokens into those pools and collected NEAR. This replaces direct wallet-to-wallet transfers with apparent purchases and sales, which could make recipients look like investors earning legitimate trading profits. Network wallets conducted all sales of the six tokens, which were traded intensively soon after creation with no trading since November 8. Each cost about $90 to create.
All transactions remain publicly recorded on the blockchain, allowing investigators to trace them. Elliptic noted, however, that additional obfuscation steps take time to unravel, which can help launderers move funds before associated wallets are identified. Transactions can be blocked, the firm said.
In its November 9 update, Elliptic put conversions into bitcoin at approximately $225 million, with $2.85 billion frozen or seized and roughly $3 billion remaining in theft-linked addresses.
The FBI on October 31 attributed the theft of more than $6 billion in virtual assets from Binance, the world's largest cryptocurrency exchange, to North Korea. The bureau has identified the activity as "TraderTraitor." Pyongyang has denied being involved. The theft occurred on October 29 across 11 blockchains, and Elliptic estimates losses at $6.43 billion, which the FBI describes as the largest cryptocurrency theft on record.
According to Elliptic, the tokens have no apparent practical purpose beyond moving funds within the laundering network. The launderers set up exchange pools holding their tokens and NEAR wallets containing stolen NEAR, while other wallets in the network sold the same tokens into those pools and collected NEAR. This replaces direct wallet-to-wallet transfers with apparent purchases and sales, which could make recipients look like investors earning legitimate trading profits. Network wallets conducted all sales of the six tokens, which were traded intensively soon after creation with no trading since November 8. Each cost about $90 to create.
All transactions remain publicly recorded on the blockchain, allowing investigators to trace them. Elliptic noted, however, that additional obfuscation steps take time to unravel, which can help launderers move funds before associated wallets are identified. Transactions can be blocked, the firm said.
In its November 9 update, Elliptic put conversions into bitcoin at approximately $225 million, with $2.85 billion frozen or seized and roughly $3 billion remaining in theft-linked addresses.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.