Liquidity-pool transactions, rather than direct wallet-to-wallet transfers, were used to move stolen Binance crypto assets, according to findings attributed to blockchain analytics firm Elliptic in a BlockBeats report published on November 9, 2026, at 21:51:27 UTC+8.
Elliptic said North Korea-linked money launderers were minting meme tokens with no buyers and using decentralized-exchange liquidity pools to route funds without sending them directly from wallets holding stolen assets to receiving wallets. The firm identified the method on Tron and NEAR, with a similar approach also appearing on Solana.
The reported transaction sequence
The report described activity across three networks:
- Tron, November 2: Elliptic identified worthless tokens created specifically to launder funds stolen from Binance.
- Solana, November 3: Stolen SOL was exchanged for wrapped and thinly traded tokens, which were then sold for USDC. The funds were subsequently moved across chains.
- NEAR, November 5–7: The launderers minted at least six meme tokens—FUK, OLCCL, MEILI, MMLI, DABI and SINU—and paired each with NEAR in a separate liquidity pool. Each pool cost approximately 25 NEAR, or about $90, to create.
Approximately 117,000 stolen NEAR, valued at about $430,000 at the prices cited in the report, was routed through those tokens. Receiving wallets then transferred out nearly equivalent amounts, with most of the funds moving into stablecoins or cross-chain bridges.
What the pool activity showed
None of the six NEAR tokens had recorded trades since November 8. That afternoon, the creators of four of the tokens withdrew the remaining liquidity from their pools.
The report also said approximately 11.8 million stolen NEAR, valued at about $43.7 million, remained unmoved. These figures describe the position reported at publication, not a current balance.
A longer tracing path, not hidden destinations
Elliptic said it first observed a similar technique during the laundering of funds stolen from Bybit in 2025. In that case, launderers minted worthless tokens on Tron and paired them with stablecoins in liquidity pools, moving at least $24 million.
The distinction for tracing is the transaction path: the reported method inserts token swaps and liquidity pools between wallets instead of relying on a direct transfer. According to Elliptic, this does not conceal where the funds go, but it increases the time needed to trace them on-chain.
Original source: BlockBeats, November 9, 2026, 21:51:27 UTC+8, citing Elliptic.