Minted

Crash

Richard

<p><strong>Elliptic says wallets linked to the reported Binance hack used six NEAR meme tokens and DEX liquidity pools in an alleged effort to obscure fund flows.</strong></p>
<p>Elliptic and the FBI attributed the reported theft to North Korea's TraderTraitor group (operating under the Lazarus Group umbrella). Elliptic said it involved <a href="https://www.elliptic.co/insights/north-korea-meme-coins-binance-hack/" rel="noopener noreferrer nofollow">$6.43 billion from Binance on October 29, 2026</a>, across 11 blockchains, in what the firm described as an unprecedented single exchange compromise. For related coverage, see <a href="https://www.nftenex.com/binance-hack-1-5b-crypto-liquidations/" rel="noopener noreferrer nofollow">Binance Hack Triggers $1.5B Crypto Liquidation Wave</a>.</p>
<figure style="margin:24px 0;padding:24px;border:1px solid #d8dee9;border-left:5px solid #f3ba2f;background:#10151f;color:#f8fafc;font-family:Arial,sans-serif">
 <div style="margin:0 0 8px;color:#f3ba2f;font-size:12px;font-weight:700;letter-spacing:0.12em;text-transform:uppercase">
  Total reported theft
 </div>
 <div style="margin:0;font-size:42px;line-height:1.05;font-weight:800;letter-spacing:-0.04em">
  $6.43 billion
 </div>
 <figcaption style="margin-top:12px;color:#cbd5e1;font-size:14px;line-height:1.45">
  Elliptic says the October 2026 Binance hack was the largest crypto theft in history.
 </figcaption>
</figure>
<h2 id="how-elliptic-says-binance-hack-linked-wallets-used-themed-meme-coins">How Elliptic Says Binance-Hack-Linked Wallets Used Themed Meme Coins</h2>
<p>Between November 5 and 7, 2026, six tokens were minted on NEAR: FUK, OLCCL, MEILI, MMLI, DABI, and SINU. According to Elliptic's on-chain analysis, the tokens carried cartoon animal logos, including a bow-wearing monkey, a flag-draped duck, a chimpanzee, and a fox, alongside an image labeled "Elon 2028 President." Each cost approximately 25 NEAR, or around $90 at the time, to mint. Context on this theme: <a href="https://www.nftenex.com/binance-hack-why-bitcoin-didnt-crash-like-2018/" rel="noopener noreferrer nofollow">Binance Hack: Why Bitcoin Didn't Crash Like It Did in 2018</a>.</p>
<p>Elliptic described the alleged laundering mechanism as four steps: a new token and a decentralized exchange liquidity pool are created; funds it identified as stolen enter from one set of wallets to buy the token; a separate set of wallets sells the token back into the pool to withdraw assets; and the direct on-chain link between the original funds and the exit wallet is broken. Elliptic noted that DABI, MMLI, and SINU each had exactly one buying wallet and one selling wallet, a pattern it said was consistent with controlled laundering rather than organic trading activity.</p>
<p>Elliptic reported that all liquidity was pulled on November 8, 2026. It said outside trading across all six tokens amounted to less than 1% of total volume, reinforcing its assessment that these were not speculative retail tokens but instruments engineered to move value. The same technique was reportedly first deployed during <a href="https://nftenex.com/binance-hack-1-5b-crypto-liquidations/" rel="noopener noreferrer nofollow">the Bybit hack in February 2025</a>, where at least $24 million moved through a worthless token on the Tron network.</p>
<p>According to Elliptic's report, approximately 117,000 NEAR, worth around $430,000 at the time, moved through the six tokens.</p>
<figure style="margin:24px 0;padding:24px;border:1px solid #d8dee9;border-left:5px solid #7c3aed;background:#fafafa;color:#111827;font-family:Arial,sans-serif">
 <div style="margin:0 0 8px;color:#6d28d9;font-size:12px;font-weight:700;letter-spacing:0.12em;text-transform:uppercase">
  Routed through six tokens
 </div>
 <div style="margin:0;font-size:36px;line-height:1.1;font-weight:800;letter-spacing:-0.035em">
  ~117,000 NEAR (~$430,000)
 </div>
 <figcaption style="margin-top:12px;color:#4b5563;font-size:14px;line-height:1.45">
  Elliptic estimates this was less than 0.01% of the reported $6.43 billion theft.
 </figcaption>
</figure>
<p>Elliptic reported that the meme coin activity on NEAR was not isolated. The firm also documented a worthless Tron token used on November 2, and said that on November 3, SOL it identified as stolen was swapped into thinly-traded Solana tokens and then sold for USDC, adding further complexity to the trail across multiple chains.</p>
<h2 id="why-meme-coin-mints-can-complicate-crypto-tracing">Why Meme-Coin Mints Can Complicate Crypto Tracing</h2>
<p>Tom Robinson, co-founder of Elliptic, explained the strategic logic plainly: "Meme coins are launched and traded in their thousands, and most fade within days, so one more short-lived token with a cartoon logo attracts little attention. A wallet whose history shows trades in a new meme coin looks like a speculator rather than a launderer, unless someone checks where its money came from."</p>
<p>Robinson also framed the technique's limits: "Home-made meme tokens are simply one more layer. It does not hide the funds so much as slow down the people tracing them." Blockchain transactions remain publicly visible regardless of how many intermediate assets they pass through, but each hop adds investigative work and time.</p>
<p>Elliptic reported that activity it linked to an alleged broader laundering operation was running at a scale that made the meme coin activity look like a minor test. <a href="https://www.elliptic.co/insights/the-binance-hack-is-laundering-on-autopilot/" rel="noopener noreferrer nofollow">Elliptic's automated laundering report</a> tracked 546 transfers from a single wallet firing every approximately 96 seconds, moving $7 to $11 million per hour without pause for more than 31 hours. The firm identified over 20,000 wallets and 16 chains it said were involved in the operation, which it said the <a href="https://www.nftenex.com/kim-jong-un-north-korea-memes-binance-6-3b-hack/" rel="noopener noreferrer nofollow">FBI formally attributed</a> to TraderTraitor.</p>
<p>Elliptic warned crypto businesses to treat the meme coin pattern as a compliance red flag, specifically: freshly minted tokens, liquidity pools with only a handful of wallets, wallets that only buy versus wallets that only sell, and new wallets funded just before trading in round amounts. Funds arriving through liquidity pools should not be treated as inherently clean.</p>
<h2 id="what-the-report-means-for-binance-users-and-the-wider-market">What the Report Means for Binance Users and the Wider Market</h2>
<p>Binance co-CEO Richard Teng confirmed that $2.85 billion in stolen funds had been frozen or intercepted as of Elliptic's reporting. Roughly $3.2 billion remained unlaundered at that time, with recovery efforts ongoing across multiple jurisdictions and chains. The <a href="https://www.nftenex.com/cz-praises-us-authorities-binance-hack-fallout/" rel="noopener noreferrer nofollow">response from U.S. authorities</a> drew public acknowledgment from exchange leadership.</p>
<p>Elliptic published a free blocklist of illicit addresses from the Binance hack at elliptic.co/binance-hack-2026-blocklist to help exchanges, wallets, and DeFi protocols screen incoming funds. The firm did not confirm or deny whether AI agents are directing the operation; its assessment pointed to conventional automation with human oversight rather than autonomous AI decision-making.</p>
<p>The meme coin laundering tactic is a reminder that the creator economy infrastructure built for legitimate token launches, cheap minting, public DEX pools, and rapid liquidity deployment, can be repurposed as obfuscation tooling at near-zero cost. The broader market dislocation from the hack continued to show up across token ecosystems weeks after the initial theft, with NEAR trading at $3.62 and a market cap of approximately $4.75 billion at the time of Elliptic's research. Users seeking account-security updates should rely on official Binance communications rather than third-party reporting.</p>
<div class="site-qc-box" style="border:1px solid #3a3a3a;border-left:4px solid #3b82f6;padding:14px 16px;margin:28px 0 12px;font-size:14px;line-height:1.5">
 <p style="margin:0 0 12px;font-size:16px"><strong>Editorial credits</strong></p>
 <div style="gap:12px;align-items:flex-start;margin:0 0 12px"><span style="flex:0 0 44px;width:44px;height:44px;border-radius:50%;background:#1f2937;color:#e5e7eb;align-items:center;justify-content:center;font-weight:700;font-size:15px">SG</span>
  <div>
   <div><a href="https://nftenex.com/author/stacey-george" rel="noopener noreferrer nofollow"><strong>Stacey George</strong></a>
   </div>
   <div style="font-size:13px;opacity:.8">
    Writer · NFTenex
   </div>
  </div>
 </div>
 <div style="gap:12px;align-items:flex-start;margin:0 0 12px"><span style="flex:0 0 44px;width:44px;height:44px;border-radius:50%;background:#1f2937;color:#e5e7eb;align-items:center;justify-content:center;font-weight:700;font-size:15px">CA</span>
  <div>
   <div><a href="https://nftenex.com/chloe-anderson" rel="noopener noreferrer nofollow"><strong>Chloe Anderson</strong></a>
   </div>
   <div style="font-size:13px;opacity:.8">
    Duty editor · NFTenex
   </div>
   <div style="font-size:13px;margin-top:2px">
    Monitors published articles around the clock and can correct or withdraw them.
   </div>
  </div>
 </div>
 <p style="margin:4px 0 8px">Checked by <a href="https://nftenex.com/how-we-review" rel="noopener noreferrer nofollow">NFTenex QC Team</a> before publishing on November 10, 2026 for headline accuracy, factual consistency, metadata, commercial disclosure and authorship claims: our AI review system checks every article before it goes live, and our duty editor monitors it after publication. <a href="https://nftenex.com/contact-us/" rel="noopener noreferrer nofollow">Report an error</a>.</p>
 <p style="margin:0;font-size:12px;opacity:.8">NFTenex uses AI for research, drafting and review. Our editorial team is responsible for every article and corrects or withdraws articles when needed. <a href="https://nftenex.com/how-we-review" rel="noopener noreferrer nofollow">How we review</a>.</p>
</div>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p><a href="https://www.nftenex.com/?p=11924" rel="noopener noreferrer nofollow">Read original article on nftenex.com</a>

Elliptic Says Binance-Hack-Linked Wallets Minted Animal and ‘Elon 2028’ Meme Tokens on NEAR

Table of Contents

NFTENEX

Other articles published on Nov 13, 2026

Join our free newsletter for daily crypto updates!