Key Highlights
- Blockchain analytics firm Elliptic uncovered an obfuscation method where cybercriminals use disposable liquidity pools on networks like NEAR, Tron, and Solana to mask illicit fund movements.
- Between November 5 and 7, illicit actors deployed six throwaway tokens on NEAR Protocol for roughly $90 each to wash approximately 117,000 NEAR ($430,000) using isolated buyer and seller wallets.
- Elliptic cautions compliance teams that while funds remain traceable on-chain, roughly 11.8 million stolen NEAR (valued at $43.7 million) still sits dormant awaiting potential laundering.
Novel Liquidity Pool Smurfing Identified Across Multiple Blockchains
Blockchain intelligence firm Elliptic has detailed an evolving on-chain money-laundering technique that leverages custom-made tokens and decentralized liquidity pools to obscure paper trails. The process relies on an intentional structural separation between incoming and outgoing assets: bad actors use one cluster of digital wallets holding illicit funds to purchase a newly minted, otherwise worthless token from a decentralized pool. Simultaneously, a disconnected set of wallets dumps those newly created tokens back into the liquidity pool to extract the underlying native cryptocurrency.
By positioning a decentralized liquidity pool directly between the purchasing and liquidating addresses, illicit networks introduce an intermediary layer that disrupts automated heuristic links. Elliptic first detected this specific laundering pipeline while tracing assets diverted from Bybit in 2025. In that incident, North Korean-linked launderers minted a bespoke token on the Tron network, channeling at least $24 million through a liquidity pool. A nearly identical laundering playbook resurfaced in the aftermath of a major Binance theft.
Rapid Execution Across Tron, Solana, and NEAR Protocol
On November 2, Elliptic flagged another newly minted asset on Tron engineered explicitly for fund obfuscation. The following day, diverted Solana (SOL) holdings were swapped into wrapped, thinly traded digital tokens before perpetrators converted the proceeds into USDC and moved them across external blockchains. However, Elliptic noted that transactions executed on the NEAR Protocol yielded the clearest architectural proof of the ongoing laundering pipeline.
Between November 5 and 7, the operatives minted six distinct tokens on NEAR: FUK, OLCCL, MEILI, MMLI, DABI, and SINU. Deploying each token required an overhead of approximately 25 NEAR, or roughly $90 at current valuations. The illicit actors then routed approximately 117,000 NEAR—worth close to $430,000—through these bespoke pools. Blockchain forensic evidence confirmed that the addresses buying the fabricated tokens were seeded directly with stolen NEAR tokens.
Burner Tokens and Closed-Loop Transaction Architecture
The operational forensics revealed that virtually identical sums were subsequently withdrawn via independent addresses. The launderers converted the majority of these extracted balances into stablecoins or routed them through cross-chain bridges. Chain data verified that retail or organic market participants had no interaction with these assets. Instead, wallets directly affiliated with the laundering ring accounted for almost the entire transaction volume.
For tokens such as DABI, MMLI, and SINU, activity was restricted to exactly one buying address and one selling address. The assets experienced intense trading immediately upon creation before being immediately discarded, with none of the six tokens registering any decentralized trading volume after November 8. Furthermore, Elliptic demonstrated that residual proceeds from earlier deployed tokens were recycled to finance the deployment of later ones, linking the operations together.
Why This Matters
Although the technique adds complexity to forensic tracking, it does not erase the immutable transaction history recorded on public ledgers. Investigators can still reconstruct the flow of capital, but routing funds through multi-layered smart contract swaps and segregated intermediary wallets forces compliance systems and forensic investigators into far more labor-intensive manual reviews.
Because the deployment cost on modern Layer-1 networks is negligible—costing attackers less than $100 per asset—the process can be repeated at scale across dozens of decentralized protocols. The $430,000 routed through the six NEAR tokens represents merely a fraction of the total haul; Elliptic estimates that roughly 11.8 million NEAR, worth around $43.7 million, remains untouched in perpetrator-controlled wallets. As a result, Elliptic has issued direct warnings to compliance desks, urging anti-money laundering (AML) teams not to treat withdrawals from liquidity pools as inherently clean, especially when interacting with newly deployed smart contracts exhibiting low wallet participation and short-lived transaction surges.
Frequently Asked Questions
Does laundering crypto through liquidity pools make funds untraceable?
No. The method does not erase on-chain records. While the use of separate buying and selling wallets introduces delays and complicates automated tracking, forensic analysts can still trace the movement of funds from one side of the liquidity pool to the other.
How much stolen crypto remains unlaundered in this operation?
According to estimates by Elliptic, while roughly $430,000 (117,000 NEAR) was moved through the six identified burner tokens, approximately 11.8 million NEAR—valued at about $43.7 million—remains sitting dormant in illicit wallets.
What warning signs should compliance teams watch for?
Elliptic advises exchanges and compliance departments to scrutinize liquidity pools tied to freshly minted tokens, markets with abnormally low wallet diversity (such as single-buyer and single-seller arrangements), and recipient wallets that were funded immediately prior to executing trades.
