Blockchain analytics firm Elliptic says hackers linked to North Korea routed about 117,000 NEAR Protocol (NEAR), worth an estimated $430,000, through six self-issued meme coins after a theft from Binance. Some tokens used imagery associated with Elon Musk, who had no connection to them. The transactions made the stolen funds appear on-chain as meme-coin trading, and Elliptic urged exchanges that received funds from the activity to review those flows.
Six meme coins used to route the funds
The NEAR was part of a theft in October involving $6.4 billion in assets, which the FBI attributed to North Korea. Elliptic said the operators spent about $90 to create each meme coin, paired each token with NEAR, and placed the pairs in liquidity pools on decentralized exchanges.
One set of wallets used the stolen NEAR to buy the newly issued tokens. Other wallets then sold those tokens to recover NEAR. Rather than moving directly from the theft wallets to recipients, the funds passed through token trades. On-chain, the sales resembled ordinary traders cashing out.
Tokens featured Musk and US-themed imagery
Elliptic said the tokens’ designs used American imagery. One logo featured a duck and the US flag; another showed Musk beneath a banner reading “Elon President 2028.” Musk was not involved with the tokens, and his likeness was used only as part of their design.
Using meme coins and liquidity pools split the transfers into a series of buys and sells, adding steps for investigators to examine when tracing the funds. Elliptic specifically called on exchanges that had received funds from the transactions to review the flows. It did not name the exchanges or provide details of any follow-up action.
More than 11.8 million stolen NEAR remains unmoved
Elliptic identified about 117,000 NEAR, worth roughly $430,000, in the transfers. That is only a portion of the $6.4 billion theft. The firm said more than 11.8 million stolen NEAR has not moved, and its eventual destination remains unclear.
For exchanges, the challenge is not limited to identifying the original theft addresses; they also need to trace assets recovered after token trades. The disclosed activity outlines how six meme coins were used to route funds, but does not indicate whether or when the unmoved NEAR will be transferred.