Blockchain analytics firm Elliptic has uncovered a sophisticated laundering operation in which North Korean-linked hackers created six new memecoins on the NEAR Protocol blockchain to obscure funds stolen from a Binance hack — a development that underscores the rapidly evolving tradecraft of state-sponsored crypto crime and the growing misuse of decentralized infrastructure as a financial escape hatch.
The scheme represents a meaningful escalation in obfuscation technique. Rather than relying on established privacy tools or cross-chain bridges — methods that blockchain investigators have grown adept at tracking — the threat actors turned to freshly minted tokens, exploiting the near-zero cost of token creation on NEAR to generate financial noise. By spinning up six distinct assets and routing stolen capital through liquidity pools associated with those tokens, the hackers introduced multiple layers of artificial market activity designed to break the forensic trail that on-chain investigators depend on.
Liquidity Pools as Laundering Infrastructure
The choice of liquidity pools as the primary obfuscation mechanism is tactically significant. In a standard token swap through a decentralized liquidity pool, funds from one wallet enter a shared reserve and different funds exit to another wallet. From a forensic standpoint, that pooling effect can complicate direct wallet-to-wallet tracing, since the specific assets deposited are commingled with assets from other participants. When hackers control both the tokens and the pools — as appears to be the case here — they can effectively manufacture the appearance of organic trading activity while quietly repositioning stolen capital across addresses they control.
This is not the first time North Korean cyber units have leaned on decentralized finance architecture to launder proceeds. The Lazarus Group and affiliated actors have been attributed to billions of dollars in crypto theft over the past several years, with money-movement strategies evolving from early mixer services to cross-chain bridges to, now, bespoke token ecosystems built expressly for a single laundering operation. The memecoin vehicle adds an additional layer of plausible deniability — in a market where thousands of low-liquidity tokens launch weekly, six new NEAR-based assets would barely register as anomalous without the kind of deep forensic investigation Elliptic conducted.
Why NEAR?
The selection of NEAR Protocol as the laundering venue deserves scrutiny. NEAR is a proof-of-stake Layer-1 blockchain with relatively low transaction fees, fast finality, and a growing decentralized exchange ecosystem — all features that make it operationally convenient for high-frequency token swapping. Compared to Ethereum, where gas costs and congestion can complicate rapid multi-hop laundering, NEAR offers a frictionless environment for creating tokens and seeding liquidity pools quickly and cheaply. The blockchain's comparatively lower profile in law enforcement monitoring, relative to chains like Bitcoin or Ethereum, may also factor into the operational calculus.
It is also worth noting that the original stolen funds originated from Binance, one of the world's largest centralized exchanges, before being funneled into this decentralized ecosystem. This cross-venue movement — from a centralized exchange breach to a Layer-1 DeFi environment — illustrates the porous boundaries between centralized and decentralized infrastructure when it comes to illicit fund flows. Compliance teams at centralized exchanges can freeze assets and cooperate with law enforcement, but once funds migrate into permissionless DeFi protocols, the levers available to investigators narrow considerably.
Elliptic's Forensic Trail
Elliptic's ability to trace these movements despite the deliberate obfuscation speaks to the maturation of blockchain analytics. The firm connected the six NEAR tokens back to the original stolen Binance funds by following wallet clustering patterns, timing correlations, and behavioral fingerprints that persist even when hackers attempt to fragment activity across multiple assets and pools. That Elliptic could reconstruct the trail does not mean the laundering failed in every sense — some portion of funds may have already been successfully moved into less traceable positions — but it does mean the operation was not invisible.
The public attribution of these techniques also serves a secondary purpose: it raises the operational cost for future campaigns by signaling that memecoin-based laundering on alternative Layer-1s is now within scope for blockchain forensics firms. Each time a novel laundering vector is publicly documented and mapped, the advantage held by threat actors using that vector diminishes.
What This Means for the Industry
For exchanges, compliance officers, and blockchain developers, the Elliptic findings carry a clear message: the attack surface for state-sponsored money laundering now explicitly includes low-profile Layer-1 ecosystems and the DeFi primitives built on them. NEAR Protocol's ecosystem developers and any decentralized exchanges operating on that network now face increased scrutiny and may need to consider on-chain monitoring partnerships or voluntary compliance frameworks to avoid becoming a preferred laundromat for sanctioned actors. More broadly, the case reinforces the argument that anti-money laundering obligations cannot remain confined to the fiat on-ramps and off-ramps of the crypto economy — the rails in between matter just as much.
Written by the editorial team — independent journalism powered by Bitcoin News.