North Korea’s launderers are creating their own meme coins to move funds stolen from Binance.
Between November 5 and 7, they launched at least six tokens on NEAR, dressed up with meme-coin logos such as a monkey in a pink bow and a duck in front of a US flag. Stolen NEAR went into a liquidity pool through one set of wallets and came out through another, so no transfer links the two directly. About 117,000 NEAR (around $430,000) passed through the six tokens before they were abandoned.
Almost nobody outside the laundering network bought them. They exist only to put a pool between the stolen funds and the next wallet.
The trail can still be followed on-chain. For compliance teams, funds arriving from a liquidity pool are not clean by default, especially when the token is only days old. @tomrobin explains how the technique works and the warning signs to screen for: hubs.la/Q04DL65d0
Between November 5 and 7, they launched at least six tokens on NEAR, dressed up with meme-coin logos such as a monkey in a pink bow and a duck in front of a US flag. Stolen NEAR went into a liquidity pool through one set of wallets and came out through another, so no transfer links the two directly. About 117,000 NEAR (around $430,000) passed through the six tokens before they were abandoned.
Almost nobody outside the laundering network bought them. They exist only to put a pool between the stolen funds and the next wallet.
The trail can still be followed on-chain. For compliance teams, funds arriving from a liquidity pool are not clean by default, especially when the token is only days old. @tomrobin explains how the technique works and the warning signs to screen for: hubs.la/Q04DL65d0
4
1
14
1,502
Binance hack update: the XRP has started moving. About $50 million has been swapped, mostly through THORChain into BTC, with about $226 million still to move.
Bitcoin converted from other stolen assets is now about 1,650 BTC ($124 million), almost twice the figure a day earlier. The main ETH and BTC holdings haven’t moved.
Read the full analysis: ➡️ elliptic.co/insights/how-n…
Bitcoin converted from other stolen assets is now about 1,650 BTC ($124 million), almost twice the figure a day earlier. The main ETH and BTC holdings haven’t moved.
Read the full analysis: ➡️ elliptic.co/insights/how-n…
5
3
14
7,069
Today we launched Fast track monitoring: quick access to screening and investigations.
Every critical system should have a backup. Fast track monitoring is yours, built on Elliptic Lens and Investigator. Any business, any size, up in minutes ⬇️
hubs.la/Q04Dn1l80
Every critical system should have a backup. Fast track monitoring is yours, built on Elliptic Lens and Investigator. Any business, any size, up in minutes ⬇️
hubs.la/Q04Dn1l80
2
0
2
830
Don't miss our upcoming webinar ➡️ The $6.4 billion Binance exploit: how North Korea moved the funds, and how we tracked them
We'll be walking through how the attack unfolded, showing how the stolen funds are moving and setting out the steps to take now.
Two sessions, to suit your timezone.
🗓 Wednesday, November 4 | 9am ET / 2pm GMT
🗓 Thursday, November 5 | 4pm SGT / 8am GMT
Register now: hubs.la/Q04DfmRv0
We'll be walking through how the attack unfolded, showing how the stolen funds are moving and setting out the steps to take now.
Two sessions, to suit your timezone.
🗓 Wednesday, November 4 | 9am ET / 2pm GMT
🗓 Thursday, November 5 | 4pm SGT / 8am GMT
Register now: hubs.la/Q04DfmRv0
2
0
4
786
There are a lot of questions around the $6.43 billion Binance hack, so we wanted to give you the opportunity to ask them.
Dr. Tom Robinson, our Founder and Chief Scientist, will answer them on video on Thursday. Submit yours here ➡️ hubs.la/Q04D63th0
Dr. Tom Robinson, our Founder and Chief Scientist, will answer them on video on Thursday. Submit yours here ➡️ hubs.la/Q04D63th0
2
1
4
680
Elliptic retweeted
Thank you Hong Kong FinTech Week for having me! 🇭🇰
Four humans on stage, designing payment rails for a world of mostly machines. With Patricia Ho (@circle), @ArdaAkartuna (@elliptic) and Jia Hang (@DCS_DeCard).
#HKFTWxSMUHK
Four humans on stage, designing payment rails for a world of mostly machines. With Patricia Ho (@circle), @ArdaAkartuna (@elliptic) and Jia Hang (@DCS_DeCard).
#HKFTWxSMUHK
1
1
21
1,353
Exposure to the $6.43 billion stolen from Binance presents significant sanctions risks for firms that handle cryptoassets. TraderTraitor hasn’t been specifically designated to date, but it’s closely affiliated with designated North Korean state actors, and OFAC-administered sanctions prohibit exporting financial services to North Korea.
David Carlisle sets out what compliance teams should check, from indirect exposure to continuous monitoring and look-backs. Acting also gives law enforcement information that could support further asset freezing.
➡️ hubs.la/Q04D03yW0
David Carlisle sets out what compliance teams should check, from indirect exposure to continuous monitoring and look-backs. Acting also gives law enforcement information that could support further asset freezing.
➡️ hubs.la/Q04D03yW0
4
1
7
836
North Korea is laundering the $6.43 billion stolen from Binance, and it’s moving fast.
Join our briefing as we explore how the attack unfolded, how Elliptic attributed it and traced the funds through thousands of new wallets, bridges, decentralized exchanges, lending vaults and mixers.
Nov 4, 9am ET | Nov 5, 4pm SGT
Register here ➡️ hubs.la/Q04C_Y8Z0
Join our briefing as we explore how the attack unfolded, how Elliptic attributed it and traced the funds through thousands of new wallets, bridges, decentralized exchanges, lending vaults and mixers.
Nov 4, 9am ET | Nov 5, 4pm SGT
Register here ➡️ hubs.la/Q04C_Y8Z0
0
1
9
738
Binance hack update: the laundering is running on conventional automation, with about 12,000 wallets on 11 blockchains and more than 40,000 transactions in under four days.
➡️ $3.24 billion still sits in linked addresses, mostly ETH and BTC
➡️ $2.85 billion has been frozen
➡️ The first mixing has started, with about 28 BTC ($2.2 million) run through Wasabi-style coinjoins
Read the full analysis: hubs.la/Q04CZ-wP0
➡️ $3.24 billion still sits in linked addresses, mostly ETH and BTC
➡️ $2.85 billion has been frozen
➡️ The first mixing has started, with about 28 BTC ($2.2 million) run through Wasabi-style coinjoins
Read the full analysis: hubs.la/Q04CZ-wP0
4
8
25
2,713
The Binance hack is laundering on autopilot. The main Tron distribution wallet has paid out every hour for 31 hours. Its longest pause was 46 minutes, and swaps into THORChain repeat the same amounts, with one value appearing 19 times.
When a bridge rejected deposits, the funds were re-sent automatically from new wallets. The timing looks programmed.
For anyone screening, a wallet that clears today can receive funds from this cluster hours later. One-off checks and static lists won’t catch it. Screen continuously and set alerts. Elliptic’s free blocklist of exploit addresses is updated as our investigators trace new ones.
Figures are Elliptic data as of 08:11 UTC on October 31 and will move.
hubs.la/Q04CYFlc0
When a bridge rejected deposits, the funds were re-sent automatically from new wallets. The timing looks programmed.
For anyone screening, a wallet that clears today can receive funds from this cluster hours later. One-off checks and static lists won’t catch it. Screen continuously and set alerts. Elliptic’s free blocklist of exploit addresses is updated as our investigators trace new ones.
Figures are Elliptic data as of 08:11 UTC on October 31 and will move.
hubs.la/Q04CYFlc0
9
3
19
2,191
Elliptic has published its Binance exploit blocklist through a public Model Context Protocol (MCP) server, so you can check addresses against it from Claude and other AI assistants.
➡️ hubs.la/Q04CY4gP0
It’s free, with no account or API key, and serves the same addresses e list now holds more than 2,800 addresses and grows as our investigators trace new ones. The attacker is still moving funds, so check new deposits and withdrawals against it now.
➡️ hubs.la/Q04CY4gP0
It’s free, with no account or API key, and serves the same addresses e list now holds more than 2,800 addresses and grows as our investigators trace new ones. The attacker is still moving funds, so check new deposits and withdrawals against it now.
9
0
6
1,162
Elliptic has published a free blocklist of the addresses tied to the $6.43 billion Binance exploit
The list currently holds 48 addresses and Elliptic's Intelligence Team will update this in real time as new addresses are identified.
Access it here ➡️ hubs.la/Q04CVhM20
The list currently holds 48 addresses and Elliptic's Intelligence Team will update this in real time as new addresses are identified.
Access it here ➡️ hubs.la/Q04CVhM20
1
1
6
868
On October 29, $6.43 billion in cryptoassets was stolen from Binance, in what is almost certainly the largest theft of any kind in history. Elliptic has verified $2.84B (44%) frozen and believes North Korea-linked actors are behind it.
Read the full breakdown ➡️ hubs.la/Q04CS7cp0
Read the full breakdown ➡️ hubs.la/Q04CS7cp0
3
5
15
2,346
Addresses linked to the $5bn+ Binance hack are now labelled in Elliptic, so our customers are screening against them in real time while funds are still moving.
We’re adding more as our intel analysts continue to investigate, and as we continue to work closely with Binance’s team on the response.
We’re adding more as our intel analysts continue to investigate, and as we continue to work closely with Binance’s team on the response.
0
2
8
1,081
The Financial Stability Board’s final AI sound practices call for firms to keep records showing which AI agent took each action, and to name an accountable person for each agentic use case.
Both expectations are in its final Sound Practices for Responsible Adoption of AI, published on October 15. The 12 practices also tell firms to run due diligence on every third-party AI provider, but they stop short of saying what a provider should be able to evidence.
The Elliptic Standard sets that out for on-chain risk. Elliptic's Global Head of Policy and Regulatory Affairs, Meera Judge, read the two side by side to show where they converge and what compliance teams should require of any provider of agentic on-chain risk management solutions. hubs.la/Q04CC4v70
Both expectations are in its final Sound Practices for Responsible Adoption of AI, published on October 15. The 12 practices also tell firms to run due diligence on every third-party AI provider, but they stop short of saying what a provider should be able to evidence.
The Elliptic Standard sets that out for on-chain risk. Elliptic's Global Head of Policy and Regulatory Affairs, Meera Judge, read the two side by side to show where they converge and what compliance teams should require of any provider of agentic on-chain risk management solutions. hubs.la/Q04CC4v70
5
3
9
917
The on-chain AI economy needs rails. It also needs rules.
Join Arda Akartuna on the panel “Agentic Payments: Building the Rails for Onchain AI Economy” at #HKFintechWeek.
🗓️ Tue 3 Nov, 2:15 PM
📍 HKCEC, Hall 5FG
Meet us at the UK Pavilion, 5BC-CA09, or book a meeting: hubs.la/Q04CrBGt0
Join Arda Akartuna on the panel “Agentic Payments: Building the Rails for Onchain AI Economy” at #HKFintechWeek.
🗓️ Tue 3 Nov, 2:15 PM
📍 HKCEC, Hall 5FG
Meet us at the UK Pavilion, 5BC-CA09, or book a meeting: hubs.la/Q04CrBGt0
0
0
1
751
「Elliptic スタンダード」日本語版を公開しました。
AI時代のオンチェーンリスク管理、何を基準に評価すべきか。8つの原則をまとめています。
The Elliptic Standard is now available in Japanese.
hubs.la/Q04CrBGN0
AI時代のオンチェーンリスク管理、何を基準に評価すべきか。8つの原則をまとめています。
The Elliptic Standard is now available in Japanese.
hubs.la/Q04CrBGN0
1
0
2
679
デモのご予約・ミーティングのご相談はこちらから / Book a demo or schedule a meeting: elliptic.co/contact/
0
0
1
225