Security / Binance / Blockchain analysis
Binance Hack Funds Routed Through Throwaway Meme Coins, Elliptic Says
Elliptic traced about $430,000 from the Binance theft through six NEAR meme tokens. Its findings show how token trades can disguise the origin of funds.
About 117,000 NEAR, worth roughly $430,000 at the report's prices, passed through six disposable meme tokens linked to the October Binance theft, blockchain analytics firm Elliptic reported on November 9. Its investigation describes wallets using token trades to make stolen funds arrive at other wallets as apparent trading proceeds. The transactions remained publicly traceable. Read Elliptic's findings.
The tokens appeared between November 5 and 7, 2026. Their branding included animals and an image of Elon Musk. Elliptic explicitly says there is no suggestion Musk had any connection to the tokens. The imagery supplied a familiar meme-coin appearance, not evidence of celebrity participation.
A trading receipt is not proof of origin
A liquidity pool is a reserve of assets held by a smart contract, a program on a blockchain. Traders exchange one asset for another through that reserve without matching directly with another trader. This is a common decentralized-exchange design, explained in Uniswap's pool documentation. That reference explains the concept, not the identity of the exchange involved here.
In Elliptic's account, the NEAR pools sat between wallets buying the newly created tokens and other wallets selling them. Money entered through purchases funded from the theft and left through sales. The receiving wallets showed proceeds from a pool rather than a direct transfer from the wallet holding stolen assets.
A transaction record can establish that a sale happened. It does not prove that the seller and buyer acted independently or that the money entering the pool came from a lawful source. Those questions require examining the surrounding transactions and the relationships between wallets.
Six tokens with little outside trading
Elliptic identified FUK, OLCCL, MEILI, MMLI, DABI and SINU. It says each traded heavily soon after creation and then stopped. At the time of the report, none had traded since November 8. The creators of four, not all six, had withdrawn their remaining pool liquidity that afternoon.
Elliptic bases its conclusion on the trading and funding patterns. Wallets it assigned to the laundering network accounted for every sale across all six tokens and every purchase across five. A small number of outside purchases in FUK made up less than 1% of that token's volume. DABI, MMLI and SINU each had just one buying wallet and one selling wallet, according to the analysis.
Elliptic also found that proceeds from earlier tokens funded five of the six creators. Most trading occurred within a day of launch, and the quantity of stolen NEAR entering the activity closely matched the quantity leaving the collecting wallets. Elliptic treats these linked funding flows and brief bursts of trading as evidence of laundering. Elliptic's evidence section provides the detailed account.
Those wallet assignments and totals remain Elliptic's findings. Monero Love has not independently reconstructed the six pools' transaction histories. Agreement among news reports citing the same analysis is not independent confirmation of the underlying wallet links.
Which Binance theft, and whose attribution?
This report concerns the October 29, 2026 theft from Binance. The FBI's October 31 notice attributes that theft to North Korea and calls the malicious cyber activity TraderTraitor. Elliptic connects the later meme-token activity to funds from that incident. The FBI notice predates those tokens and does not independently verify Elliptic's November findings.
Published estimates of the original theft differ. Elliptic's earlier assessment puts it at $6.43 billion and reports Binance's estimate as about $6.3 billion. TRM Labs calculated approximately $6.36 billion, valuing transfers at the time of theft. The reports do not reconcile every difference in their totals. The $430,000 traced through the six tokens is a small subset.
The incident is separate from the 2022 BSC Token Hub bridge exploit and the February 2025 Bybit theft. Elliptic describes similar token-based laundering after Bybit, but that earlier case does not establish who controlled a particular wallet in this one. Our Binance incident timeline covers the original breach and the exchange's response.
What the public trail can establish
Elliptic says the transactions add work for investigators without erasing the chain of transfers. Public records show asset movements. Identifying who controls addresses, why trades occurred and whether later recipients knew the origin involves further evidence and analysis.
The findings concern particular tokens and wallets. Ordinary meme-coin trading is not evidence of wrongdoing. Elliptic says the token-launch tool, exchange and wallet application did nothing wrong. Their use in the reported activity is not evidence that those services participated in it.
For a business reviewing a deposit, the immediate sender is only part of its history. Elliptic's warning is that a pool payout should not automatically count as legitimate trading income. The report leaves several questions unanswered: which recipients accepted these proceeds, whether authorities froze later deposits, and how much of the $430,000 has been recovered.