A liquidity pool can separate two wallets in a transaction trail without making the underlying funds untraceable. That distinction is central to Elliptic’s account of how North Korean hackers used newly created meme coins to move a portion of the reported $6.4 billion stolen from Binance.
In an article published on November 10, 2026, at 03:36:02 UTC+8, Decrypt reported on Elliptic research credited to co-founder Tom Robinson. The blockchain analytics firm said the launderers used the tactic on Tron and Near, with a close variant on Solana.
How the pool separates the wallets
According to Elliptic, the process involves creating a token with no underlying value and pairing it with an asset such as NEAR or a stablecoin in a decentralized-exchange liquidity pool:
- One set of wallets uses stolen assets to buy the newly minted token through the pool.
- A separate set of wallets sells that token into the pool.
- The selling wallets withdraw the paired asset, appearing to have received proceeds from ordinary meme-coin trading.
The relevant distinction is between a direct wallet-to-wallet transfer and transactions routed through a shared pool. No stolen funds move directly from the buying wallet to the collecting wallet, but Elliptic stressed that the on-chain trail remains fully traceable. The extra steps slow investigators rather than erase the record.
The Near activity: November 5–8
The clearest example described in the report involved at least six tokens created on Near between November 5 and 7. Each had its own pool paired with NEAR, and each cost approximately 25 NEAR, or roughly $90, to create.
The tokens used familiar meme-coin imagery: a bow-wearing monkey, a flag-draped duck, a chimpanzee and a fox. One featured an “Elon 2028 President” image of Elon Musk, who had no connection to the tokens. Names included FUK and SINU.
Elliptic described the same sequence across all six: creation, heavy trading within hours using stolen NEAR, then abandonment. The remaining liquidity was withdrawn on November 8.
Approximately 117,000 NEAR, valued at roughly $430,000, passed through the six tokens. Much of that subsequently moved into stablecoins or a cross-chain bridge. Those figures describe the reported flow through these pools, not the total amount stolen or laundered.
Traceable does not mean immediately stopped
The pool activity represented a relatively small portion of the reported theft. Elliptic had previously found that more than $3 billion of the stolen cryptocurrency remained unlaundered, while the launderers were creating a new wallet roughly every 25 seconds.
The firm said it first observed the meme-coin tactic in the previous year while tracing the $1.5 billion Bybit theft, also attributed to TraderTraitor, the group identified as responsible for the Binance breach.
For compliance teams, Elliptic’s warning was specific: receiving funds from a liquidity pool is not evidence that those funds are clean. Newly minted tokens and trading concentrated among a handful of wallets warrant scrutiny. The pool changes the route visible in the ledger; it does not, by itself, establish a legitimate origin for the assets.
Original source: Decrypt, published November 10, 2026, at 03:36:02 UTC+8.