Key Highlights:
- Blockchain forensics firm Elliptic revealed how North Korean threat actors laundered stolen $NEAR tokens by hopping between wallets and decentralized liquidity pools.
- Investigators identified a connected chain where five of six token creators were funded by proceeds from prior token sales within a rapid two to 13-minute window.
- Approximately 11.8 million stolen $NEAR, valued at $43.7 million at the time of analysis, remains unmoved following the Binance security breach.
Tracing the Flow of Stolen Binance Assets
Blockchain analytics firm Elliptic has uncovered sophisticated obfuscation tactics deployed by North Korean cyber operatives following the high-profile theft of $NEAR tokens from Binance. According to the firm’s investigative report, illicit actors utilized a rapid sequence of token deployments, decentralized liquidity pools, and multi-wallet hops to obscure the movement of compromised crypto assets across the ecosystem.
A closer look at the on-chain paper trail revealed a tightly coordinated laundering pipeline. Elliptic found that five of the six token creators identified in the scheme were funded directly with proceeds generated from earlier token sales. These funding events took place within a narrow window of just two to 13 minutes before each subsequent token launch, establishing an undeniable, interconnected chain of transactions executed to stay ahead of automated compliance tracking.
“North Korea’s launderers rarely rely on a single technique,” Elliptic co-founder Tom Robinson wrote in the report. “Instead, they layer many cheap techniques, each adding a little more delay.”
Parallels to the 2025 Bybit Exploitation
The laundering blueprint seen in the Binance incident is not an isolated occurrence. Elliptic noted that the exact same methodology was deployed in the wake of the massive $1.5 billion Bybit hack in 2025. In that incident, North Korean-affiliated threat actors laundered at least $24 million by routing funds through an asset newly generated on the TRON blockchain, mirroring the rapid creation and liquidity absorption strategies observed in the $NEAR ecosystem.
Despite these extensive laundering cycles, significant volumes of the stolen capital have yet to be converted or laundered. At the time of Elliptic’s analysis, approximately 11.8 million $NEAR tokens tied to the Binance hack remained static across tracked addresses. Elliptic placed the market valuation of these unmoved assets at roughly $43.7 million.
Why This Matters
The persistent use of bespoke token launches and decentralized exchanges by state-sponsored actors underscores the evolving challenges confronting crypto compliance teams and law enforcement agencies. Rather than depending exclusively on sanctioned mixing protocols, North Korean laundering syndicates increasingly turn to rapid, low-cost decentralized finance (DeFi) primitives to construct operational friction. By layering simple automated mechanisms across multiple networks and liquidity pairs, malicious entities buy critical operational time, making real-time asset freezes and asset recovery increasingly difficult for centralized exchanges and bridge operators.
Frequently Asked Questions
How did attackers move the stolen $NEAR tokens?
The operatives utilized a chain of newly minted tokens and liquidity pools. Proceeds from preceding token sales were used to fund five out of six new token creators within two to 13 minutes, creating a fast-paced loop that layered transactions across multiple intermediary wallets.
Has this specific laundering technique been used before?
Yes. Elliptic highlighted that the same layering technique was executed following the $1.5 billion Bybit breach in 2025, where North Korean-linked actors channeled at least $24 million through a novel asset deployed on the TRON network.
How much of the stolen $NEAR remains unmoved?
According to Elliptic’s analysis, roughly 11.8 million $NEAR tokens—valued at approximately $43.7 million at the time of the investigation—had not yet been moved from the associated addresses.
