Liquidity-pool swaps, rather than direct wallet-to-wallet transfers, were the key link in a laundering route described by blockchain analytics firm Elliptic. According to a Cointelegraph article published on Nov. 10, 2026, at 04:26:34 UTC+8, Elliptic attributed the activity to North Korean hackers moving funds stolen in the $6.3 billion Binance hack.
Elliptic reported that roughly $430,000 passed through six newly launched tokens on the NEAR blockchain. Between Nov. 5 and 7, the hackers created at least six tokens and used decentralized-exchange liquidity pools to move stolen funds between wallets. The tokens attracted almost no outside trading and were abandoned shortly after launch.
How the pool transactions connected the wallets
The reported sequence involved two sets of wallets:
- One set swapped stolen NEAR tokens for the newly created memecoins.
- Another set sold those memecoins back into the pools for NEAR.
This route moved funds without a direct transfer between the two wallet sets. It did not remove the onchain record: Elliptic said the transactions remained traceable.
Timing provided another connection. Elliptic found that five of the six token creators received funding from proceeds of earlier token sales just two to 13 minutes before the next launch, linking the tokens in a chain of transactions. The attribution and laundering interpretation are Elliptic’s findings; the reported swaps and funding sequence form the transaction trail supporting its analysis.
A layered technique, not an erased trail
“North Korea’s launderers rarely rely on a single technique,” Elliptic co-founder Tom Robinson wrote in the report. “Instead, they layer many cheap techniques, each adding a little more delay.”
Elliptic said the same technique was used after the $1.5 billion Bybit hack in 2025, when North Korean-linked actors moved at least $24 million through a newly created token on the TRON blockchain.
At the time of Elliptic’s analysis, about 11.8 million NEAR stolen in the Binance hack remained unmoved. Elliptic valued those funds at $43.7 million. Those figures describe the analysis snapshot, not a current balance.