Elliptic has traced how attackers used newly created meme coins and DEX liquidity pools to move stolen Binance assets.
North Korea-linked hackers are using newly created meme coins to move stolen cryptocurrency from the US$6.4 billion Binance hack, according to blockchain analytics firm Elliptic. The technique uses decentralised exchange (DEX) liquidity pools to disguise the movement of funds, with stolen assets passing through obscure tokens rather than moving directly between wallets.
Elliptic identified the method on Tron and NEAR, alongside a similar approach involving existing tokens on Solana. The technique involves creating a new token, pairing it with a legitimate asset such as NEAR in a liquidity pool, and using separate wallets to buy and subsequently sell the token. This allows stolen funds to enter and leave the pool without a direct transfer between the wallets involved.
Between 5 and 7 November, the technique became more prominent on NEAR, where attackers created at least six meme coins and paired each with NEAR in separate liquidity pools. Each token cost approximately 25 NEAR, or US$90, to create. The attackers used them to move around 117,000 NEAR, worth approximately US$430,000, through separate groups of wallets.
Wallets linked to the operation accounted for nearly all their trading activity, while five of the six token creators received funds from wallets that had sold an earlier token shortly before the new ones were launched. Each token was traded heavily shortly after its creation before being abandoned.
The funds remain traceable through blockchain data, but the use of multiple wallets, tokens and liquidity pools makes investigations more complicated. Elliptic noted that none of the six tokens had traded since 8 November, while around 11.8 million NEAR, worth approximately US$43.7 million, from the original theft remained unmoved.
Learn more about the development here.
Stay updated on crypto and AI by following our socials
