Binance Hack: Disposable Memecoins Launder Stolen Crypto on NEAR

The Binance hack, with estimated losses of $6.3 to $6.4 billion, has been followed by a laundering operation built on disposable memecoins. According to Elliptic, launderers minted tokens on NEAR, Tron and Solana to place an opaque asset between stolen funds and their final destination.

A breach with contours still unclear

Binance’s spokesperson described an “incident de sécurité” in French, or security incident, while founder Changpeng Zhao said the situation “looks like a hack”. Binance suspended all deposits and withdrawals and said customers would be fully reimbursed. The company added that an attacker may have compromised an engineer’s laptop, enabling unauthorized withdrawals.

The spokesperson said Binance “will cover all losses” and cited an estimated total impact of about $6.3 billion. Tether froze more than $1.5 billion in crypto linked to a “potential Binance hack”, while Circle froze more than $800 million “associated with the incident”. Bitcoin fell below $80,000 for the first time in more than a month.

An amount still disputed, an attribution not yet settled

Totals vary by source. The New York Times and Bloomberg cite $6.3 billion, while Elliptic and Decrypt use $6.4 billion, and the available sources cannot reconcile the two figures. The table below summarizes the key numbers.

TRM Labs said it has “high confidence” the attack was carried out by “North Korea’s elite hacking unit”, based on traits resembling earlier thefts. The attribution is not presented as settled: a Bloomberg page also referenced a November 2 article titled “North Korea Denies Role in $6.3 Billion Binance Crypto Theft”.

The precedent weighs heavily. In February 2025, Bybit lost $1.5 billion in an attack attributed to North Korean hackers, previously the largest crypto theft on record. Binance also revisited its regulatory history: in 2023 it pleaded guilty to violating anti-money laundering laws and paid $4.3 billion in US penalties. Changpeng Zhao was sentenced to four months in prison and later received a pardon from President Donald Trump after his release. Binance also has a business relationship with World Liberty Financial, the crypto venture of the Trump family.

The mechanism: a liquidity pool as a holding cell

According to Elliptic, whose research is credited to co-founder Tom Robinson, launderers adapted a method already seen in the Bybit theft, in three steps:

1. Create a worthless digital asset and pair it with a real asset, such as NEAR or a stablecoin, in a decentralized exchange liquidity pool.
2. Send stolen funds into that pool from a first set of wallets to buy the token.
3. A second set of wallets sells the token back into the same pool and withdraws the real asset.

Stolen funds never move directly from the buyer wallet to the collector wallet. To an untrained observer, the collector looks like an ordinary trader who sold a memecoin at a profit. The tokens were built to be used once and abandoned: no one outside the operation bought them, and the operators set their prices.

“Our teams are working tirelessly to resolve this issue safely and thoroughly.”

Binance spokesperson, public statement

The public minting tool, the decentralized exchange and the wallet app involved committed no wrongdoing: the launderers used them like any other user.

Tron and Solana follow the same logic

The method was observed on Tron and NEAR, with a close variant on Solana. On November 2, Elliptic identified a worthless Tron token created solely to launder funds, following a pattern similar to the Bybit theft. In 2025, a comparable technique had moved at least $24 million through a stablecoin-linked token on Tron. On November 3, stolen SOL was swapped on Solana for thinly traded existing tokens, then sold for USDC and bridged to other chains.

NEAR: six memecoins in three days

Between November 5 and 7, the best-documented case emerged on NEAR. Launderers created at least six new memecoins, each paired with NEAR in its own liquidity pool.

The logos borrowed familiar meme codes: a monkey with a pink ribbon, a duck in front of an American flag, a chimpanzee, a fox, a flaming golden badge, and an image of Elon Musk under a “President Elon 2028” banner. Musk has no connection to these tokens. The name SINU derives from canine memecoins suffixed with “INU”.

Each creation cost roughly 25 NEAR, about $90. The tokens were used immediately: first sales occurred within three hours of creation, and at least three quarters of trades took place on a single day. In each case, the amount of NEAR entering the pool matched the amount leaving it. As of the report, none of the six had traded since November 8, when the creators of four of them removed the remaining liquidity that afternoon.

The buyer wallets were funded with stolen money. About 117,000 NEAR, moved from the main wallet holding stolen NEAR through intermediary accounts, entered the six pools, roughly $430,000 at Elliptic’s prices. Nearly the same amount flowed out soon after to collector wallets, much of it converted into stablecoins or sent across a cross-chain bridge. These sums remain small relative to the theft: about 11.8 million NEAR, or $43.7 million, had not yet moved.

Several signals confirm the tokens existed only to launder funds. The network made all sales of the six tokens and bought every unit of five of them; the only outside activity was a few small FUK purchases on day one, under 1% of its volume. DABI, MMLI and SINU each had just one buyer wallet and one seller wallet. Five of the six creators were funded by a wallet that had already sold an earlier token, two to thirteen minutes before the next launch: one token’s proceeds financed the next.

The method does not make funds invisible; every step remains publicly recorded on the blockchain. Its aim is to slow investigators and buy time in a race to move funds before they are flagged. Elliptic notes that North Korean launderers typically stack several cheap techniques rather than rely on one; memecoins are simply one more disposable layer.

Compliance red flags

For compliance teams, Elliptic warns that a wallet receiving funds from a liquidity pool should not be presumed clean. Warning signs include:

• a token created in the preceding few days;
• a pool used by a small number of wallets;
• wallets that only buy the token, while others only sell it;
• new wallets funded shortly before their first transactions, often with round sums.

Firms must examine what entered a pool, not just who paid. Elliptic maintains a public blocklist of wallets linked to the Binance hack; as new addresses are identified, previously accepted deposits should be re-screened. Its Continuous Monitoring service automatically re-examines wallets and transactions to identify deposits from the laundering network.

Outlook: a test for on-chain surveillance

The case reaches well beyond Binance. It shows how malicious actors exploit open infrastructure: every step remains visible on-chain, but the slowness of controls leaves them a window to act. If North Korea’s role is confirmed, pressure on exchanges and monitoring providers is likely to intensify, and retroactive re-screening of deposits could become standard practice.

Three scenarios stand out. In the first, public traceability enables further freezes and partial recovery. In the second, launderers move most of the remaining balance, including the 11.8 million NEAR, before freezes take effect. A middle path would see part of the funds frozen and the rest laundered through less-monitored chains. Markets remain sensitive to freeze announcements and attribution headlines, which can move prices in either direction.

Sources

• Decrypt
• Yahoo Finance
• The New York Times
• Bloomberg
• Techmeme
• Elliptic

Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.