Launderers behind the Binance hack are minting throwaway Elon and animal memecoins to move stolen NEAR, Elliptic says

The money launderers working the $6.4 billion Binance hack have started spinning up disposable memecoins to help shuffle stolen funds, blockchain analytics firm Elliptic said in a report released Monday and detailed by The Block.

Elliptic traced roughly 117,000 NEAR — worth about $430,000 at the time — into six memecoins created between Nov. 5 and Nov. 7, then quickly abandoned. The tokens carry the usual memecoin trappings: animal mascots, one expletive ticker, and one featuring Elon Musk under an "Elon 2028 President" banner. Elliptic said there is no suggestion Musk is linked to it.

The mechanics are the point. Launderers route stolen NEAR into a token through a decentralized-exchange liquidity pool: one set of wallets buys the memecoin with dirty NEAR, a separate set sells into the same pool and collects clean NEAR. "At no point do the stolen funds move directly from a buying wallet to a collecting wallet, because the pool sits in between," Elliptic wrote — so the collecting wallets "look like ordinary traders who have sold a token at a profit." Elliptic said much of the collected NEAR then moved into stablecoins or cross-chain bridges, and that it found a similar approach on Solana using existing low-liquidity tokens.

It is a repeat. Elliptic said the same tactic followed the 2025 Bybit hack, when launderers pushed around $24 million through a homemade token paired with a stablecoin on Tron.

Key facts

• 117,000 NEAR ($430,000) routed through six memecoins minted Nov. 5–7, since abandoned — Elliptic, via The Block.
• Laundering method: DEX liquidity pools separating "buying" wallets from "collecting" wallets — Elliptic.
• ~$24 million moved the same way after the 2025 Bybit hack, via a token paired with a stablecoin on Tron — Elliptic.
• Remaining stolen NEAR: 11.8 million, ~$42.7 million at current prices — Elliptic/The Block.
• Separately, ~$124 million of stolen assets converted to bitcoin as of Friday — Elliptic.
• Total breach: $6.4 billion; Binance's incident report cites malicious developer software, a fake job interview and compromised AI tooling, and says the FBI linked the attack to North Korea.

The real-world read

Mind the proportions. The memecoin maneuver is colorful — a fake Musk 2028 token moving stolen crypto writes itself — but $430,000 is a rounding error against the $42.7 million of NEAR still outstanding and the $6.4 billion stolen overall. Elliptic itself frames these swaps as speed bumps, not disappearing acts: the transfers stay public and traceable on-chain, meant only to buy time before wallets get flagged. Two attributions to keep straight. Elliptic is a forensics vendor whose business is tracing exactly this, and the account of how the breach happened — months of planning, a fake interview, poisoned AI tooling — comes from Binance's own incident report, i.e. the hacked exchange describing its own compromise. The FBI's North Korea attribution is relayed through Binance, not quoted directly here. None of that is contradicted by other evidence; it just isn't independently confirmed in what's on the table.

Opinion, and whose

Elliptic's read — that the memecoin and low-liquidity-token swaps are deliberate obfuscation reprising the Bybit playbook — is the firm's analytical judgment, not an established fact. No independent forensic confirmation of that characterization appears alongside it.

This is news coverage, not financial advice.

Sources

• The Block (secondary reporting), Nov. 9, 2026 — reported Elliptic's findings on the six NEAR memecoins, the laundering mechanics, the Bybit comparison, the bitcoin-conversion and remaining-NEAR figures, and Binance's incident-report details. The Block relies on Elliptic's report as its primary source.
• Elliptic (primary analytics source, via The Block) — the Monday report and Friday update underlying every figure above.
• Binance incident report / FBI (via The Block) — the exchange's own account of the attack vector and the FBI's North Korea attribution; an interested party describing its own breach.