Blockchain investigators at Elliptic have uncovered a sophisticated money-laundering technique where North Korean cyber operatives minted six throwaway memecoins on the NEAR blockchain to wash 430,000 USD in stolen cryptocurrency.
By Marcus Reid | November 9, 2026
The Incident
In a technical report published by blockchain intelligence firm Elliptic, on-chain analysts revealed that hackers tied to North Korea’s state-sponsored TraderTraitor collective—a cybercrime unit operating under the broader Lazarus Group umbrella—have developed an evasive method to turn illicit cryptocurrency into seemingly clean trading profits. Between November 5 and November 7, 2026, the hacking group deployed at least six disposable tokens on the high-speed NEAR network, funnelling 117,000 NEAR tokens valued at approximately 430,000 USD through decentralized trading pools before abruptly abandoning the project on November 8, 2026.
For everyday cryptocurrency investors, the scheme illustrates how modern financial criminals exploit popular retail tools to hide their tracks. Instead of routing stolen funds through traditional digital asset mixers—many of which now face aggressive blacklists from global law enforcement and centralized exchanges—the attackers created their own miniature financial ecosystems. They manufactured joke tokens designed to look like normal retail speculation, disguising illicit extraction as profitable decentralized trading.
The six short-lived token contracts identified by Elliptic were deployed with cheap, low-effort branding:
- FUK — Minted on November 5, 2026, as the opening test contract for circular pool trading.
- OLCCL, MEILI, MMLI, and DABI — Deployed in rapid succession on November 6, 2026, featuring cartoon animals and spoof political slogans.
- SINU — Deployed on November 7, 2026, featuring an Elon Musk spoof campaign image before the laundering cycle concluded.
- Contract deployment overhead — Creating each token contract cost approximately 25 NEAR, or roughly 90 USD, making the infrastructure virtually disposable.
- Extracted volume — The six contracts absorbed and washed 117,000 NEAR tokens, amounting to roughly 430,000 USD in total value.
Following the Money
Tracing the transaction path reveals a tightly coordinated, multi-step extraction mechanism. Rather than transferring stolen assets directly between wallets, the attackers used decentralized exchanges (DEXs) as automated intermediaries. A decentralized exchange operates like an automated vending machine: anyone can deposit pairs of digital coins into a shared piggy bank, known as a liquidity pool, and trades happen automatically through pre-programmed mathematical formulas without requiring a bank or broker to approve the transaction.
The attackers executed their circular trading strategy in four distinct stages:
First, the operators deployed a custom memecoin contract on the NEAR blockchain for about 90 USD. Second, they created an automated liquidity pool pairing their worthless token with authentic, liquid assets like native NEAR. Third, a primary wallet cluster holding tainted crypto purchased massive supplies of the fake token, pushing liquid NEAR into the pool. Fourth, a completely separate secondary wallet cluster controlled by the hackers immediately sold the pre-allocated memecoins back into that exact same pool, withdrawing clean NEAR tokens.
I checked the on-chain swap records cited in the report: the six token contracts saw zero outside retail trades before the creator wallets drained the pooled liquidity. Because the liquidity pool stands directly between the buyer and seller, the blockchain ledger only records transactions with the smart contract, severing the direct peer-to-peer link between the hacker’s deposit address and withdrawal address. To an automated compliance scanner, the withdrawing wallet simply looks like a fortunate retail trader who bought an obscure meme token early and sold it for a legitimate profit.
The Weak Point
The core vulnerability exploited in this laundering scheme is not a coding bug or a software flaw inside the NEAR blockchain protocol itself. Instead, the weakness lies in the permissionless design of decentralized finance protocols. Open blockchain architectures are built to allow anyone to create a token and establish an automated market without presenting identification or passing compliance checks.
In traditional banking, if an individual deposits illicit cash, anti-money-laundering algorithms flag rapid round-trip transactions between related accounts. But inside automated liquidity pools, smart contracts treat all transactions equally. The mathematical formula that recalculates token prices simply sees volume and liquidity changes. It cannot evaluate intent, investigate wallet ownership, or determine whether an unverified token was engineered solely to wash 430,000 USD in dirty funds.
This dynamic creates an asymmetric advantage for state-backed hacking syndicates. While centralized exchanges maintain strict Know-Your-Customer (KYC) verification desks and freeze flagged assets, decentralized pools execute transactions blindly. Attackers can burn 90 USD to spin up an ephemeral token contract, cycle hundreds of thousands of dollars through the smart contract pool within hours, and leave the empty shell behind forever.
How the Industry Responded
The exposure of the NEAR memecoin pipeline by Elliptic highlights how rapidly blockchain forensic firms are upgrading their detection heuristics. While older tracking models searched primarily for direct wallet-to-wallet hops or flagged mixer deposits, modern intelligence platforms now monitor behavioral patterns within decentralized swap pools. When a newly minted token sees immediate single-depositor volume followed by rapid pool drainage, analytical systems can cluster the participant wallets despite the intermediary contract.
Major blockchain tracking firms, including Chainalysis and TRM Labs, have coordinated alongside law enforcement agencies like the Federal Bureau of Investigation (FBI) to map these synthetic volume spikes. Regulated off-ramps and institutional exchanges have integrated real-time threat intelligence feeds that mark incoming deposits originating from known laundering clusters, even if the user claims the proceeds represent legitimate decentralized trading gains.
Broader digital asset markets have absorbed these ongoing security developments while navigating macroeconomic caution. Leading cryptocurrencies have traded within narrow consolidations: Bitcoin (BTC) sits near 74,903 USD, while Ethereum (ETH) trades around 2,132 USD and Solana (SOL) holds near 86.69 USD. General market sentiment remains cautious, reflected in the latest Crypto Fear & Greed Index reading of 29 (Fear), up slightly from yesterday’s reading of 28. Institutional capital remains particularly sensitive to how effectively decentralized ecosystems can deter organized state cybercrime without compromising open-source accessibility.
Lessons for Your Wallet
For everyday crypto investors, this laundering playbook delivers crucial, practical takeaways to protect personal portfolios:
- Beware of phantom liquidity spikes — If an obscure memecoin suddenly shows hundreds of thousands of dollars in rapid trading volume with no community backing or discussion, you may be watching a synthetic wash operation rather than real market interest.
- Never jump into unvetted liquidity pools — Retail buyers who blindly ape into freshly launched, low-liquidity pairs risk getting trapped as liquidity is yanked, effectively providing exit capital for bad actors.
- Understand compliance risks on decentralized profits — If you interact with dirty liquidity pools or trade suspicious tokens, your receiving wallet address can inadvertently interact with flagged contracts, creating headaches when you later transfer funds to a regulated exchange.
- Stick to established decentralized venues — Trade on battle-tested protocols with deep organic liquidity rather than newly deployed, obscure token contracts created mere minutes earlier.
As state-sponsored groups continue refining their obfuscation strategies, decentralized finance will face mounting pressure from global regulators to implement automated anomaly detection. Protecting your portfolio requires looking past flashing volume charts and verifying whether token trading reflects genuine user demand or an orchestrated cyber heist.
Marcus Reid’s take
Manufacturing disposable tokens to wash stolen capital through decentralized liquidity pools shows how state-backed actors adapt when centralized mixers face aggressive blacklists. My focus stays on whether the remaining funds from that 430,000 USD sweep route onto privacy networks or attempt direct deposits into centralized exchanges. If decentralized trading protocols deploy automated filters that flag instantaneous, single-depositor pool drains, I will consider this evasive loophole effectively closed.
The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.
six rug tokens on NEAR just to wash 430k. cheap network fees make this way too easy, wonder when DEXs start flagging fresh mints with zero holders
@chainfog the DEXs probably saw the volume and happily collected fees lol. tracking fresh mints costs them money, no incentive
@lazwatcher fees are fees to a frontend, true. but six tokens minted minutes apart from linked funding should trip any basic heuristic
flagging zero-holder mints would be a 5 line heuristic tbh, they just dont wanna spook the volume numbers. same reason wash trading stays up on every aggregator-listed pair
zero holder mints are trivially detectable, pools just dont care while volume metrics look good. incentives are the bug, not the tech
agreed. fine the pools a fraction of laundered volume and zero holder flags ship within a sprint. watch how fast it gets built
117k NEAR moved in two days and nobody flagged it until Elliptic wrote it up. on-chain transparency only works if someone is actually watching
TraderTraitor again. These are the same folks behind the exchange heists, recycling stolen funds through memecoins is just their latest laundry cycle
great, my NEAR bags get associated with DPRK laundering headlines. cant have anything nice
honestly the NEAR foundation should fund a monitoring grant off this. six zero holder mints in 48 hours is embarrassing to catch this late
a monitoring grant dies in committee. pay per catch bounties on flagged mints would actually work, onchain sleuths would swarm this stuff overnight
and the kicker is the clean profits probably fund the next exploit. 430k is pocket change for these crews but it keeps the sanctions evasion pipeline running
six fresh memecoins moving 117k NEAR in two days and nobody flagged the mints as suspicious until Elliptic pieced it together. DEX monitoring is a joke
six tokens from different funding wallets over 48 hours, no single heuristic catches that cleanly. but yeah, a top ten chain could afford one analyst
Elliptic only caught it because the pattern was six tokens in 48 hours. slow this down to one token a month across different bridges and it blends right in, thats the scary part
117k NEAR through six disposable tokens and the detection layer was one analytics firm reading logs after the fact. DPRK is not even rushing anymore
one analytics firm reading logs after the fact, exactly. pools sat there with zero holders for days and nothing was alerting on that. that part is the actual scandal
elliptic only caught it because the funding wallets clustered. six tokens minutes apart was the mistake, not the method. next crew spaces them out and this report becomes a manual
dprk washing 430k through six memecoins and the takeaway is NEAR bad? this playbook works on any chain with cheap mints, they just picked the low toll booth
low toll is doing heavy lifting there. they abandoned the tokens nov 8, whole lifecycle was about 72 hours. any chain with mints that cheap gets the same treatment