Attackers linked to the Binance hack used self-created meme tokens and decentralized exchange liquidity pools to move stolen funds through transactions resembling ordinary token trading, according to an Elliptic report cited by Odaily.
The Odaily report was published on November 9, 2026, at 21:49:47 UTC+8. Elliptic said the technique had appeared on Tron, NEAR and Solana.
How the reported transaction pattern worked
According to Elliptic, the attackers first created tokens and established liquidity pools pairing them with assets such as NEAR or stablecoins. They then used different wallets to execute purchases and sales, making the movement of stolen funds appear as routine token trades and complicating on-chain tracing.
The distinction is between the visible transaction type and its reported purpose: a token swap records a trade, while Elliptic attributed these trades to an effort to move stolen funds. Elliptic emphasized that the technique does not actually conceal the on-chain flow of funds; its main effect is to delay investigations.
NEAR activity reported for November 5–7
Elliptic reported the following figures for the NEAR network:
- At least six meme tokens were created between November 5 and 7, at a cost of approximately 25 NEAR per token.
- Approximately 117,000 NEAR in stolen funds, valued at about $430,000, was moved through those tokens.
- Trading in the tokens had stopped from November 8 onward.
- Approximately 11.8 million NEAR in stolen funds, valued at about $43.7 million, remained unmoved at the time of the report.
These figures describe the activity and remaining funds reported at that historical reporting point, not a current balance assessment.
Elliptic also cited a precedent: North Korean hackers used a similar technique to move at least $24 million following the 2025 Bybit theft.
Source: Original Odaily report.