North Korean hackers used six meme coins to launder $430,000 in stolen NEAR, Elliptic says

Lazarus Group, the North Korea-linked hacking unit behind years of exchange breaches, built its reputation laundering stolen crypto through Tornado Cash until U.S. sanctions cut off that route in 2022, pivoting since to cross-chain bridges and decentralized exchanges. The 2025 Bybit hack showed the same actors scattering stolen assets across hundreds of wallets before cashing out. Binance, whose NEAR holdings were the ultimate source of the funds moved this time, has been targeted by North Korean operations before. NEAR's cheap, permissionless token creation offered a fresh, disposable laundering tool.

Exchanges and blockchain analytics firms now have to monitor newly launched meme coins on NEAR for sudden liquidity-pool activity tied to known hacker wallets, not just established tokens. Traders who bought into any of the six tokens, unaware of their origin, risk holding assets now flagged as laundering vehicles. Elliptic and similar firms must widen tracing tools beyond major chains to smaller networks like NEAR, where liquidity pools can obscure wallet-to-wallet transfers within days. NEAR Foundation faces pressure to tighten scrutiny of token launches on its network.

Permissionless token creation is the same feature that lets anyone launch a project on NEAR without gatekeepers, and it is what let North Korean operatives spin up six meme coins in three days with no oversight. Treating every new token as a potential laundering shell would choke the openness decentralized finance is built on, yet ignoring the pattern leaves liquidity pools as a ready-made obfuscation layer. Elliptic's tracing shows the technique works until analysts catch up, not that it is unstoppable.

Watch whether Binance or NEAR-based decentralized exchanges move to freeze or blacklist the specific liquidity pools Elliptic identified between Nov. 5 and Nov. 7, and whether NEAR Foundation issues guidance on vetting new token launches. A follow-up Elliptic report tracing where the $430,000 ultimately settled, on-chain or off-ramped through another exchange, would show whether this laundering channel closed or simply moved to a seventh token.

NEAR Protocol fell 0.8% in the 4 hours after the first headline, after rising 2.8% in the 2 hours before.

48 prices, one every 30 minutes · The move was larger before the first headline than after: an observation, not an explanation. The market also moves on things nobody publishes.