Elliptic Says Binance-Hack-Linked Wallets Minted Animal and ‘Elon 2028’ Meme Tokens on NEAR

Elliptic says wallets linked to the reported Binance hack used six NEAR meme tokens and DEX liquidity pools in an alleged effort to obscure fund flows.

Elliptic and the FBI attributed the reported theft to North Korea’s TraderTraitor group (operating under the Lazarus Group umbrella). Elliptic said it involved $6.43 billion from Binance on October 29, 2026, across 11 blockchains, in what the firm described as an unprecedented single exchange compromise. For related coverage, see Binance Hack Triggers $1.5B Crypto Liquidation Wave.

How Elliptic Says Binance-Hack-Linked Wallets Used Themed Meme Coins

Between November 5 and 7, 2026, six tokens were minted on NEAR: FUK, OLCCL, MEILI, MMLI, DABI, and SINU. According to Elliptic’s on-chain analysis, the tokens carried cartoon animal logos, including a bow-wearing monkey, a flag-draped duck, a chimpanzee, and a fox, alongside an image labeled “Elon 2028 President.” Each cost approximately 25 NEAR, or around $90 at the time, to mint. Context on this theme: Binance Hack: Why Bitcoin Didn't Crash Like It Did in 2018.

Elliptic described the alleged laundering mechanism as four steps: a new token and a decentralized exchange liquidity pool are created; funds it identified as stolen enter from one set of wallets to buy the token; a separate set of wallets sells the token back into the pool to withdraw assets; and the direct on-chain link between the original funds and the exit wallet is broken. Elliptic noted that DABI, MMLI, and SINU each had exactly one buying wallet and one selling wallet, a pattern it said was consistent with controlled laundering rather than organic trading activity.

Elliptic reported that all liquidity was pulled on November 8, 2026. It said outside trading across all six tokens amounted to less than 1% of total volume, reinforcing its assessment that these were not speculative retail tokens but instruments engineered to move value. The same technique was reportedly first deployed during the Bybit hack in February 2025, where at least $24 million moved through a worthless token on the Tron network.

According to Elliptic’s report, approximately 117,000 NEAR, worth around $430,000 at the time, moved through the six tokens.

Elliptic reported that the meme coin activity on NEAR was not isolated. The firm also documented a worthless Tron token used on November 2, and said that on November 3, SOL it identified as stolen was swapped into thinly-traded Solana tokens and then sold for USDC, adding further complexity to the trail across multiple chains.

Why Meme-Coin Mints Can Complicate Crypto Tracing

Tom Robinson, co-founder of Elliptic, explained the strategic logic plainly: “Meme coins are launched and traded in their thousands, and most fade within days, so one more short-lived token with a cartoon logo attracts little attention. A wallet whose history shows trades in a new meme coin looks like a speculator rather than a launderer, unless someone checks where its money came from.”

Robinson also framed the technique’s limits: “Home-made meme tokens are simply one more layer. It does not hide the funds so much as slow down the people tracing them.” Blockchain transactions remain publicly visible regardless of how many intermediate assets they pass through, but each hop adds investigative work and time.

Elliptic reported that activity it linked to an alleged broader laundering operation was running at a scale that made the meme coin activity look like a minor test. Elliptic’s automated laundering report tracked 546 transfers from a single wallet firing every approximately 96 seconds, moving $7 to $11 million per hour without pause for more than 31 hours. The firm identified over 20,000 wallets and 16 chains it said were involved in the operation, which it said the FBI formally attributed to TraderTraitor.

Elliptic warned crypto businesses to treat the meme coin pattern as a compliance red flag, specifically: freshly minted tokens, liquidity pools with only a handful of wallets, wallets that only buy versus wallets that only sell, and new wallets funded just before trading in round amounts. Funds arriving through liquidity pools should not be treated as inherently clean.

What the Report Means for Binance Users and the Wider Market

Binance co-CEO Richard Teng confirmed that $2.85 billion in stolen funds had been frozen or intercepted as of Elliptic’s reporting. Roughly $3.2 billion remained unlaundered at that time, with recovery efforts ongoing across multiple jurisdictions and chains. The response from U.S. authorities drew public acknowledgment from exchange leadership.

Elliptic published a free blocklist of illicit addresses from the Binance hack at elliptic.co/binance-hack-2026-blocklist to help exchanges, wallets, and DeFi protocols screen incoming funds. The firm did not confirm or deny whether AI agents are directing the operation; its assessment pointed to conventional automation with human oversight rather than autonomous AI decision-making.

The meme coin laundering tactic is a reminder that the creator economy infrastructure built for legitimate token launches, cheap minting, public DEX pools, and rapid liquidity deployment, can be repurposed as obfuscation tooling at near-zero cost. The broader market dislocation from the hack continued to show up across token ecosystems weeks after the initial theft, with NEAR trading at $3.62 and a market cap of approximately $4.75 billion at the time of Elliptic’s research. Users seeking account-security updates should rely on official Binance communications rather than third-party reporting.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.