EN PT-BR
← Voltar ao feed
critical cryptocurrency

TraderTraitor launders Binance theft proceeds through six NEAR meme-token liquidity pools

1 fonte(s) · 1 atualização(ões) · publicado 10/11/2026 02:39 · coletado há 1 hora

North Korea's TraderTraitor group is linked to the October 29, 2026 theft from Binance hot wallets, which the FBI attributed to it on October 31 (fbi.gov). Reported loss figures range from more than $6 billion (fbi.gov) to $6.34 billion (paloaltonetworks.com). Between November 5 and 7, the launderers created six meme tokens on NEAR, named FUK, OLCCL, MEILI, MMLI, DABI and SINU, each paired with NEAR in its own liquidity pool (elliptic.co). About 117,000 NEAR, roughly $430,000, moved through these pools: one set of wallets bought the tokens with stolen NEAR, and a second set sold them back and withdrew the NEAR, so funds never passed directly between wallets (elliptic.co). Elliptic links the method to the Bybit laundering in 2025 and to Tron and Solana activity in this case, and about 11.8 million NEAR ($43.7 million) from the theft has not moved (elliptic.co).

Detalhes técnicos

  • Token creation: each token cost about 25 NEAR (around $90) to create, and the launches took place on November 5, 6 and 7 (elliptic.co).
  • Funding chain: five token creators were funded by a wallet that had already been selling an earlier token, between 2 and 13 minutes before the next launch (elliptic.co).
  • Artificial trading: wallets in the network made every sale of all six tokens and bought every unit of five; outside purchases of FUK were under 1% of its volume (elliptic.co).
  • Lifecycle: each token was first sold within three hours of launch, did at least three quarters of its trading within one day, and stopped trading after November 8 (elliptic.co).
  • Scope: since the theft, the wider laundering has used more than 20,000 wallets, 16 blockchains, at least 36 services and at least 65,000 transactions (elliptic.co).
  • Attribution: the FBI observed TraderTraitor converting stolen assets mainly into ETH and expects further laundering through DeFi and instant swap services (fbi.gov).

Remediação

  • Screen counterparties against Elliptic's public Binance hack blocklist, and re-check deposits already accepted as the list grows (elliptic.co).
  • Do not treat a wallet funded from a liquidity pool as clean by default; check what entered the pool, not only who paid out (elliptic.co).
  • Flag tokens created within the last few days, pools traded by only a few wallets, wallets that only buy or only sell a token, and new wallets funded shortly before trading (elliptic.co).
  • Block transactions with addresses linked to the theft; the FBI published 628 addresses, including 608 Ethereum, 19 Bitcoin and one Solana address (bleepingcomputer.com).

Relatos divergentes

  • The article says attackers drained Binance wallets across 11 blockchains. Palo Alto Networks reports ten blockchains over roughly 20 minutes (paloaltonetworks.com), and the article's $6.43 billion figure does not appear in the sources opened. Elliptic uses $6.4 billion (elliptic.co) and the FBI says more than $6 billion (fbi.gov).
  • North Korea denied involvement through Kim Yo Jong on November 3, after the FBI attribution (coindesk.com). The FBI attribution and Elliptic's analysis remain the reference positions.

Linha do tempo

  1. gbhackers.com ↗ · pub. 10/11/2026 02:39 · coletado 10/11 04:00 primeiro registro

    TraderTraitor launders Binance theft proceeds through six NEAR meme-token liquidity pools

    ler a análise desta fonte

    North Korea's TraderTraitor group is linked to the October 29, 2026 theft from Binance hot wallets, which the FBI attributed to it on October 31 (fbi.gov). Reported loss figures range from more than $6 billion (fbi.gov) to $6.34 billion (paloaltonetworks.com). Between November 5 and 7, the launderers created six meme tokens on NEAR, named FUK, OLCCL, MEILI, MMLI, DABI and SINU, each paired with NEAR in its own liquidity pool (elliptic.co). About 117,000 NEAR, roughly $430,000, moved through these pools: one set of wallets bought the tokens with stolen NEAR, and a second set sold them back and withdrew the NEAR, so funds never passed directly between wallets (elliptic.co). Elliptic links the method to the Bybit laundering in 2025 and to Tron and Solana activity in this case, and about 11.8 million NEAR ($43.7 million) from the theft has not moved (elliptic.co).

    Technical Details

    • Token creation: each token cost about 25 NEAR (around $90) to create, and the launches took place on November 5, 6 and 7 (elliptic.co).
    • Funding chain: five token creators were funded by a wallet that had already been selling an earlier token, between 2 and 13 minutes before the next launch (elliptic.co).
    • Artificial trading: wallets in the network made every sale of all six tokens and bought every unit of five; outside purchases of FUK were under 1% of its volume (elliptic.co).
    • Lifecycle: each token was first sold within three hours of launch, did at least three quarters of its trading within one day, and stopped trading after November 8 (elliptic.co).
    • Scope: since the theft, the wider laundering has used more than 20,000 wallets, 16 blockchains, at least 36 services and at least 65,000 transactions (elliptic.co).
    • Attribution: the FBI observed TraderTraitor converting stolen assets mainly into ETH and expects further laundering through DeFi and instant swap services (fbi.gov).

    Remediation

    • Screen counterparties against Elliptic's public Binance hack blocklist, and re-check deposits already accepted as the list grows (elliptic.co).
    • Do not treat a wallet funded from a liquidity pool as clean by default; check what entered the pool, not only who paid out (elliptic.co).
    • Flag tokens created within the last few days, pools traded by only a few wallets, wallets that only buy or only sell a token, and new wallets funded shortly before trading (elliptic.co).
    • Block transactions with addresses linked to the theft; the FBI published 628 addresses, including 608 Ethereum, 19 Bitcoin and one Solana address (bleepingcomputer.com).

    Conflicting Reports

    • The article says attackers drained Binance wallets across 11 blockchains. Palo Alto Networks reports ten blockchains over roughly 20 minutes (paloaltonetworks.com), and the article's $6.43 billion figure does not appear in the sources opened. Elliptic uses $6.4 billion (elliptic.co) and the FBI says more than $6 billion (fbi.gov).
    • North Korea denied involvement through Kim Yo Jong on November 3, after the FBI attribution (coindesk.com). The FBI attribution and Elliptic's analysis remain the reference positions.