Elliptic Traces $430,000 From Binance Hack Through Six Meme Tokens

Blockchain analytics firm Elliptic says about 117,000 NEAR linked to the Binance hack passed through six newly created meme tokens. The firm put the value at about $430,000 in its November 9 analysis, which traced activity involving tokens created between November 5 and 7.

The finding adds a new detail to the investigation: wallets linked to the stolen funds used decentralised exchange pools to move assets between accounts. The dollar estimate covers the six tokens Elliptic examined on NEAR. It does not represent all the funds moved after the Binance breach.

Key Takeaways

• Elliptic traced roughly 117,000 NEAR through six recently created tokens.
• The swaps made the relationship between sending and receiving wallets less obvious, but the transactions remained visible on-chain.
• Elliptic links the activity to North Korean actors. The new report is a tracing update, not a recovery announcement.

What Elliptic Found on NEAR

According to Elliptic’s investigation, wallets funded with stolen NEAR bought the newly issued tokens through liquidity pools. Other wallets then sold those tokens back into the pools and received NEAR. The public ledger showed swaps with a pool rather than a direct transfer between the wallets at either end.

A liquidity pool holds assets that traders can swap without waiting for a particular buyer or seller. In this case, the pool was the intermediary. Investigators looking only for a direct transfer could miss the relationship; investigators who examine the pool activity can compare where the incoming funds came from and which wallets received the outgoing assets.

Cointelegraph’s reporting on November 10 also noted that the six tokens drew almost no outside trading and were abandoned soon after launch. Elliptic said none had traded since November 8 at the time of its report. That short lifespan helps explain why the firm interpreted the activity as an attempt to move funds rather than a conventional token launch.

What the $430,000 Figure Means

The figure is Elliptic’s dollar valuation of the NEAR it traced through the six tokens. It is not a separate loss at Binance, and a traced transfer does not show that anyone recovered or froze the assets. Readers comparing reports should check which wallets, networks and dates each estimate covers.

UEEx’s earlier coverage of the Binance wallet breach focused on how Binance said attackers reached its systems. Elliptic’s analysis starts later in the timeline and asks where some of the assets went. Both questions matter, but they rely on different evidence: an account of the intrusion and a record of subsequent blockchain transactions.

Why the Finding Matters for Exchanges

A deposit can arrive from an address that has never received a direct transfer from a wallet associated with a hack. Its history may still include a swap, a pool or another network. Checking the immediate sender alone can therefore miss information further back in the chain of transactions.

Elliptic reported that much of the NEAR leaving the receiving wallets went into stablecoins or toward a bridge. UEEx’s guide to cross-chain interoperability explains why bridges matter when assets move between networks. For an investigator, a change in asset or network creates a new place to look for evidence; it does not by itself settle who controls the receiving wallet.

The pattern also has limits as a screening signal. Many new tokens have little trading activity, and traders routinely use liquidity pools for ordinary swaps. The relevant evidence here is the combination of funding links, trading patterns and outgoing flows, rather than the age of a token alone. The UEEx crypto hacks archive gives readers more cases for comparing the original breach with what investigators later establish about the funds.

Conclusion

Elliptic’s analysis identifies one route taken by a small portion of the assets linked to the Binance hack. The swaps put a pool between the wallets, but enough of the transaction history remained visible for investigators to reconstruct the route. The next facts to watch are further verified movements and any confirmed freezes or recoveries.