Blockchain analytics company Elliptic has revealed that an unprecedented method was used to conceal the trail of cryptocurrencies stolen from Binance. According to the company’s research, the attackers, believed to have North Korean links, conducted fake trading transactions using six memecoins they created themselves.
Approximately 117,000 NEAR tokens, worth about $430,000 at the time of the transaction, were traded using this method. It was stated that the memecoins were created between November 5th and 7th, and a separate NEAR liquidity pool was established for each token on a decentralized exchange.
According to Elliptic, the attackers purchased these memecoins in exchange for the stolen NEAR using a group of wallets. Another group of wallets then sold the same memecoins to obtain NEAR. Thus, instead of the assets being directly transferred from one wallet to another in connection with the attack, the attackers attempted to make it appear as if they were earned from a successful memecoin trade.
It was determined that almost all transactions in the six tokens were made by wallets linked to the system. External investors reportedly accounted for less than 1% of the volume in any given token. Trading activity in all tokens ceased as of November 8th.
The FBI holds the North Korea-linked TraderTraitor group responsible for the October 29th attack that stole approximately $6.3 billion from Binance. North Korea denies the cyberattack allegations. Therefore, information regarding memecoin transactions relies on Elliptic’s on-chain analysis and references from official institutions.
Elliptic stated that the method makes fund tracking more difficult but does not eliminate transaction traces on the blockchain. The analytics company noted that a similar method was used in the Bybit attack in 2025.
*This is not investment advice.
