Liquidity pools, rather than direct wallet-to-wallet transfers, were the intermediary in a laundering method described by blockchain analytics firm Elliptic, according to a Foresight News report published on November 9, 2026, at 21:48:22 UTC+8. Elliptic said the hackers behind the Binance theft used self-created, worthless meme tokens to move stolen assets.
How the pool-mediated transfers worked
Elliptic described four steps:
- The hackers created new tokens using publicly available token-launch tools.
- They paired those tokens with assets such as NEAR or stablecoins to establish liquidity pools on decentralized exchanges.
- One group of wallets used stolen funds to buy the newly created tokens from the pools.
- A separate group sold those tokens back into the same pools, withdrawing the assets paired with them.
The key distinction in the transaction record is the intermediary: stolen assets did not move directly from the buying wallets to the withdrawing wallets. Instead, both groups interacted with a liquidity pool. According to Elliptic, this could make the withdrawing wallets appear to be ordinary traders realizing gains from token sales.
Reported activity and amounts
Elliptic said the Binance hackers had used the method on Tron and NEAR, with a similar approach also used on Solana.
Between November 5 and 7, 2026, the hackers reportedly created at least six meme tokens on NEAR, at a creation cost of approximately 25 NEAR each. Around 117,000 NEAR in stolen funds—valued at approximately $430,000—was moved through those tokens. Trading in the tokens had ceased from November 8 onward.
At the time of the report, approximately 11.8 million NEAR in stolen funds, valued at about $43.7 million, remained unmoved.
Traceable, but slower to investigate
Elliptic said the technique did not conceal the funds from on-chain tracing; its main effect was to slow investigations. The firm also said North Korean hackers had previously used the same method to move at least $24 million in connection with the 2025 Bybit theft.
Source: Foresight News original article, published November 9, 2026, at 21:48:22 UTC+8, reporting Elliptic’s findings.