Is Crypto Traceable? The Binance Hack Meme Coin Trick

Launderers linked to North Korea are minting their own worthless meme coins to move part of the money stolen from Binance, according to research by analytics firm Elliptic that Decrypt reported on Nov. 9. The tokens act as a buffer between the wallets that pay in stolen funds and the wallets that collect the proceeds. This article looks at how that buffer works on-chain, what it hides and what it does not.

What Elliptic found on Near, Tron and Solana

Decrypt describes the Binance theft as a record, with $6.4 billion stolen in total. Elliptic's work, which names co-founder Tom Robinson as its author, spotted the meme-coin method on Tron and Near, and a close variant on Solana.

The clearest case was on Near. Between Nov. 5 and 7, the group launched at least six self-made tokens. Each one sat in its own pool paired with Near. Launching a token cost about 25 Near tokens, or roughly $90. The coins carried ordinary meme branding, including cartoon animals and an Elon Musk image used without his involvement; Musk has no link to them. Names included FUK and SINU.

All six followed the same arc. Each saw a burst of trading with stolen NEAR in its first hours, and was then left to die. The remaining liquidity was withdrawn on Nov. 8. Elliptic put the combined flow through the six tokens at about 117,000 Near, worth roughly $430,000. Much of it was later swapped to stablecoins or sent over a cross-chain bridge.

The method: a liquidity pool as a wall between wallets

A liquidity pool is a smart contract that holds two assets and lets anyone swap one for the other at a price set by a formula. On a decentralized exchange, the pool is the counterparty. Buyers and sellers never trade with each other directly.

The launderers used that design. They created a fresh token and paired it with a real asset such as Near or a stablecoin. One group of wallets bought the token with stolen funds. A different group of wallets later sold the token back to the pool and took out the real asset.

• Step 1: mint a new token for a tiny fee.
• Step 2: open a pool pairing it with Near or a stablecoin.
• Step 3: buy the token from wallet group A using stolen funds.
• Step 4: sell it from wallet group B and withdraw the real asset.

With the pool placed between them, no transfer ever goes straight from wallet A to wallet B. A simple check of a receiving wallet shows a trader who sold a meme coin, not a wallet that received hacked funds. That is the whole point: it breaks the direct link that basic tracing tools follow first.

Is crypto traceable after a trick like this?

Yes. Elliptic stressed that the trail stays fully traceable on-chain. Every swap into and out of the pool is recorded on a public ledger, so an analyst can see which wallets put stolen NEAR in and which wallets pulled value out around the same time. The trick does not erase records. It adds a step that investigators must connect by reasoning about timing, amounts and wallet behaviour.

What it buys the launderers is time. Elliptic framed it as a race to move funds before they are flagged. Earlier research from the firm counted more than $3 billion of the loot not yet laundered, and found launderers spinning up a fresh wallet roughly every 25 seconds. A cheap pool hop is one more disposable layer on top of that churn. Elliptic says it first noticed the method last year, during its investigation of the $1.5 billion Bybit theft. That case is blamed on TraderTraitor, the same group linked to the Binance breach.

Limits: where pool-based tracing can mislead

Following funds through a pool is an inference, not a direct transfer record. That creates blind spots worth knowing.

• Shared pools: if real traders also use a pool, the link between a specific buyer and a specific seller becomes a probability, not a certainty.
• Clean-looking receivers: wallet group B can look like an ordinary profit-taker, so a quick screen may pass it.
• Chain hops: once value moves into a cross-chain bridge, the analyst must match activity on another network, which adds room for error.
• Speed and volume: with new wallets appearing every few seconds, labels can lag behind the funds.

This is why Elliptic warned compliance teams not to treat money coming out of a liquidity pool as clean, especially when the token is newly minted and only a handful of wallets trade it.

What to watch next

The sums seen so far are modest next to the size of the theft. The more useful signals are patterns: tokens that launch, trade heavily for a few hours with a small cluster of wallets, then lose their liquidity. Watch whether similar short-lived pools appear on other chains, and where the stablecoins and bridged funds from these pools end up. For anyone reading on-chain data, the lesson is that a swap is not a fresh start for the money. It is one more hop on a public trail.

Sources

• Decrypt, 9 Nov 2026

Drafted by AI from the research and on-chain sources listed, then published automatically once checks confirmed the figures against those sources and found no copied text. Not reviewed by a person. Metrics are explained, never turned into price calls.