Fake Tokens and Liquidity Pools Used to Move Funds Linked to Binance Theft

How newly created tokens became a laundering tool

Elliptic has identified a laundering method in which attackers create new tokens and use decentralized exchange liquidity pools to move cryptocurrency linked to the Binance theft. Rather than sending assets directly from one wallet to another, the operators exchange them through a token they have just launched. The extra steps make it less immediate to connect the funds entering a pool with the cryptocurrency later withdrawn, although the transactions remain recorded on-chain.

The technique starts with a newly created token paired against an established asset, such as NEAR or a stablecoin. The operators add both assets to a decentralized exchange pool, then use one set of wallets to buy the new token with stolen funds. Separate wallets sell that token back into the pool and receive the paired cryptocurrency. The pool therefore serves as an intermediary between the wallets, complicating the transaction path without making it disappear.

Elliptic says it first identified this approach while following funds stolen from Bybit in 2025. In that earlier case, North Korean launderers created a worthless token on Tron and used a liquidity pool to move at least $24 million. The method appeared again shortly after the Binance theft, across Tron, Solana and NEAR. The recurrence suggests the technique can be adapted to different blockchains, though the supplied findings do not establish that every related transaction used the same route.

A pool-based route obscures wallet connections

On November 2, Elliptic identified a newly created token on Tron that appeared to have been launched specifically for laundering. The next day, stolen SOL was exchanged for wrapped and thinly traded tokens, then converted into USDC and transferred to other blockchains. These movements show that the reported activity was not confined to one network or one asset. The account describes a sequence of swaps and transfers, rather than a direct movement from the original stolen funds to a final destination.

The reported NEAR activity provides the clearest detail on how the mechanism worked. From November 5 through November 7, the attackers created six tokens named FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each token was paired with NEAR in its own liquidity pool. Creating each token cost around 25 NEAR, or approximately $90, a relatively small amount beside the value later routed through the six pools.

Together, the six tokens were used to move around 117,000 NEAR, worth roughly $430,000. Elliptic says wallets that bought the tokens had received funding from stolen NEAR, while almost the same amount later emerged through separate wallets. Much of the withdrawn value was converted into stablecoins or sent through a cross-chain bridge. That sequence offers investigators identifiable links, even as the different wallets and conversion steps make the path more involved.

Six NEAR tokens reveal a coordinated operation

The trading pattern also distinguished the activity from ordinary market participation. Wallets connected to the operation handled almost all buying and selling, rather than a broad group of independent traders. Three tokens—DABI, MMLI and SINU—each had only one buying wallet and one selling wallet. The tokens saw heavy trading soon after launch, then were abandoned; none of the six had recorded further trading activity since November 8, according to Elliptic.

Investigators also found a link between successive token launches: proceeds from earlier tokens were used to fund the creation of newer ones. That finding connects the six-token operation and indicates that the pools were not simply unrelated experiments. It also helps explain how operators can repeat the approach: a low creation cost and reuse of recovered proceeds can support additional launches. The available account, however, does not identify every wallet or establish the eventual destination of all funds.

The central limitation of the technique is that it adds complexity rather than erasing evidence. The pool swaps and intervening wallets make it more time-consuming to connect incoming stolen assets with outgoing cryptocurrency, but the transactions still leave a blockchain record. Elliptic says investigators can continue following the funds. For tracing teams, the practical challenge is to interpret connected activity across wallets, token contracts, pools and, in some cases, blockchain bridges.

The trail remains visible, but compliance risks persist

The reported $430,000 routed through the six NEAR tokens is only a portion of the funds discussed in the investigation. Elliptic estimates that around 11.8 million NEAR, worth approximately $43.7 million, remains unmoved. That figure describes the amount the firm says had not moved, not an amount shown to have passed through the six pools. The distinction matters: the token operation is a documented slice of the activity, not a complete account of the stolen funds.

Elliptic has warned exchanges and compliance teams not to treat cryptocurrency received from liquidity pools as legitimate automatically. The source specifically identifies several warning signs for review: newly created tokens, pools with very few participating wallets, and accounts funded shortly before trading begins. None of those features alone is described as conclusive proof of laundering. Taken together with transaction links to stolen assets, however, they can help compliance teams decide which activity warrants closer examination.

Important questions remain open in the reported findings. They do not specify how much of the overall Binance theft has been routed through this method, where all proceeds ultimately went, or whether the remaining 11.8 million NEAR will move. Nor do they say that every newly launched token or low-participation pool is illicit. What the investigation does establish is narrower but practical: token swaps can slow attribution, while wallet patterns and the public transaction trail still give analysts and exchanges evidence to assess.

Source: CryptoPotato