The hacker did not directly transfer the stolen funds from one wallet to another, but instead issued tokens first, then completed the exchange through a DEX liquidity pool.
Blockchain analysis firm Elliptic disclosed on November 9 that hackers suspected to be linked to North Korea created at least six types of meme coins on the NEAR network and used decentralized exchange (DEX) liquidity pools to transfer approximately $430,000 in stolen assets from the Binance security incident.
These tokens were created gradually between November 5 and 7, involving about 117,000 NEAR. They had almost no real external trading demand, and most transactions occurred between wallets controlled or associated with the hackers. Rather than being a speculation on meme coins, it was more a transaction process specifically built for the transfer of funds. 
Issue tokens first, then build a funding transfer channel
Elliptic found that within three days, the hackers created six tokens: FUK, OLCCL, MEILI, MMLI, DABI, and SINU, and established liquidity pools paired with NEAR for each of them.
The creation cost of these tokens was very low, roughly 25 NEAR per token, which calculated to about $90 at that time. The token names and designs also fit the common meme coin style, including animal images, internet memes, and designs featuring public figures' images.
However, these tokens lacked a real community or market demand. After being created, they quickly entered an intense phase of trading, only to stop activities shortly after.
How do liquidity pools help hackers transfer funds?
The key to this operation lies in using DEX liquidity pools as intermediaries.
The entire process can be broken down into four steps:
- Create tokens: The hacker issues a new meme coin and creates a liquidity pool paired with NEAR.
- Buy tokens: The first group of wallets puts the stolen NEAR into the liquidity pool in exchange for the newly issued meme coins.
- Transfer wallets: The hacker receives these meme coins through another group of wallets, avoiding the stolen funds transferring directly from the original wallet to the target wallet.
- Sell back to NEAR: The second group of wallets then sells the meme coins back to the liquidity pool, exchanging them for NEAR to complete the fund transfer.
In this way, the flow path of the funds no longer presents as a direct transfer between two wallets but instead becomes two seemingly independent token exchanges.
For observers focused solely on the addresses of fund inflows and outflows, the NEAR received by the latter wallet might appear to be income from selling tokens rather than directly receiving stolen assets.
However, this does not mean the source of the funds is truly hidden. The liquidity pool merely adds an intermediary trading step without making the on-chain records disappear.
Almost no external buyers, six tokens are more like disposable tools
Elliptic found through trading records that these six tokens were almost entirely traded within the associated money laundering network.
Of these, the buying and selling of five tokens were mostly completed by associated wallets; FUK, although it had a small number of external purchases, accounted for less than 1% of its trading volume. DABI, MMLI, and SINU even had only one buying wallet and one selling wallet, respectively.
The fund flow also shows a clear continuity: the creators of the five tokens received funds from the previous token's transactions before issuing the new token, with intervals of only 2 to 13 minutes.
This indicates that the six tokens are not independent projects from each other but rather a linked set of funding transfer tools.
Throughout the process, approximately 117,000 NEAR entered these tokens' trading processes, followed by a nearly identical number of NEAR flowing out from another group of wallets. Related transactions practically ceased around November 8, with some remaining liquidity in the token pools also being withdrawn.
Why not transfer directly, but go through an additional layer?
A direct transfer does not mean that funds are untraceable but leaves a clear wallet association: where the funds come from, which addresses they passed through, and where they ultimately ended up can all be traced step by step through transaction records.
By exchanging through a liquidity pool, the hacker can add a layer of trading activity in the funding path, making the receiving wallet appear to be engaging in token buying and selling, rather than directly receiving stolen assets.
This method has two practical advantages:
First, it is low cost. The threshold for issuing tokens and establishing liquidity pools is low; the creation cost for a single token is about $90.
Second, tools can be quickly changed. Once a certain token has completed the fund transfer, it can be discarded, and then a new token can be issued to continue the operation.
However, this approach does not guarantee that the funds remain safe from exchange or compliance scrutiny. As long as analysts connect the transactions on both sides of the liquidity pool, the sources of wallet funds and the token creation times, they can still identify the relationships between the funds.
DeFi liquidity pools also become new tracking focus
This incident reiterates that decentralized trading tools can serve normal transactions, but may also be utilized by attackers to increase the difficulty of fund tracking.
For trading platforms, custodial institutions, and on-chain analysis teams, risk assessment cannot solely rely on which wallet a fund comes from; there must also be continued examinations of what assets, which liquidity pools, and which addresses were involved in the exchange prior to that.
Particularly, liquidity pools that are newly created, have very few traders, highly concentrated buyers and sellers, and where trading funds come from known stolen addresses are worth special attention.
Elliptic previously discovered similar methods in the 2025 Bybit theft incident, where attackers transferred at least $24 million via self-created tokens on the TRON network. The operations on NEAR indicate that this low-cost, repeatable method of fund transfer is still being used.
It is important to note that approximately $430,000 is only the scale of funds related to these six NEAR tokens and does not represent the overall handling of the stolen funds from Binance. The on-chain tracing results disclosed by Elliptic indicate that hackers are still layering assets through different networks and tools.
Meme coins are no longer used as assets for speculation here, but are temporary funding transfer tools manufactured for the purpose. For on-chain tracking, what truly needs to be focused on is not just the token prices and trading volumes, but where the funds on both sides of the liquidity pool are actually coming from and going to.
If you are also paying attention to the Crypto market, wish to participate in trading or asset allocation, you can register through the following exclusive channels and enjoy discounts:
Binance: Register through the exclusive link and fill in the invitation code aicoin668 to enjoy a 10% commission rebate.
Registration link: https://jump.do/zh-Hans/xlink-proxy?id=3
Benefit group: https://www.aicoin.com/link/chat?cid=gmLgwvKD1
OKX: Register through AiCoin's exclusive link to enjoy a permanent 20% commission rebate.
Registration link: https://jump.do/zh-Hans/xlink-proxy?id=2
Benefit group: https://aicoin.com/link/chat?cid=l61eM4owQ
Bitget: Register through AiCoin's exclusive channel to enjoy a 10% transaction fee rebate.
Registration link: https://jump.do/zh-Hans/xlink-proxy?id=6
Benefit group: https://aicoin.com/link/chat?cid=N63yYYKQE
You are also welcome to join AiCoin-related communities for more information on new tokens and earning opportunities in exchanges:
Official Telegram community: https://t.me/aicoin_support
AiCoin Chinese Twitter: https://x.com/AiCoinzh
This article only represents the author's personal views and does not reflect the position of this platform. The views, conclusions, and recommendations in the article are for investors' reference only and do not constitute any investment advice related to this platform. The market carries risks, and investment should be done with caution.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
