Elliptic Says North Korea-Linked Hackers Moved 117,000 NEAR

Elliptic said North Korea-linked hackers moved about 117,000 NEAR through meme-token trades and decentralized exchange (DEX) liquidity pools, using the activity to make funds from a Binance theft harder to trace.

The transfers took place on the NEAR network from Nov. 5 through Nov. 7. Attackers created at least six meme tokens during those three days, at a cost of about $90 each.

They used different wallets to buy and sell the tokens through liquidity pools. The trades moved about 117,000 NEAR, worth roughly $430,000, through the route. Across the three-day period, the reported flow combined token creation, activity from separate wallets and pool trades.

Elliptic described the series of token launches and trades as a way to complicate tracing the stolen funds. Similar methods were used to launder funds from the 2025 Bybit theft, making the Binance-linked activity another reported example of meme-token trades in crypto theft laundering.