North Korea's TraderTraitor group used six self-issued meme coins and decentralized-exchange liquidity pools to move about 117,000 NEAR, worth roughly $421,000, from the $6.4 billion Binance hack, Elliptic said. The tokens—FUK, OLCCL, MEILI, MMLI, DABI and SINU—were launched on NEAR between Nov. 5 and Nov. 7, 2026, at a cost of about 25 NEAR, or $90, each. The hackers paired each token with NEAR, allowing wallets holding stolen assets to deposit NEAR and receive the new token before other wallets sold it back and withdrew NEAR. That structure made the receiving wallets resemble ordinary traders who had profited, without directly transferring funds between the original and destination wallets. One token used an image of Elon Musk beneath an "Elon 2028 President" banner, although Elliptic said Musk was not connected to the project. Each token was first sold within three hours of launch, and at least 75% of its trading occurred within a day. None traded after Nov. 8, when four creators withdrew remaining liquidity. A few outside purchases of FUK represented less than 1% of its first-day volume, while the other five tokens had no outside buyers. Most of the 117,000 NEAR later moved into stablecoins or a cross-chain bridge. Elliptic said the method slows tracing rather than hiding the public on-chain trail and has also appeared on Tron and Solana. About 11.8 million stolen NEAR remained unmoved, worth roughly $42.4 million at $3.60 per NEAR. The broader laundering operation involved more than 20,000 wallets, 16 blockchains, at least 36 services and 65,000 transactions, while a similar tactic moved at least $24 million after the 2025 Bybit hack.