TLDRElliptic traced approximately 117,000 stolen NEAR through six disposable memecoins.Each token cost approximately $90 to create, according to Elliptic.Separate wallets used decentralized liquidity pools to transfer stolen assets indirectly.Outside buyers accounted for less than 1% of one token’s trading volume.Elliptic found no further trading in the six tokens after November 8.Elliptic reported Monday that North Korean hackers used disposable memecoins to route stolen Binance assets. This raises screening risks for firms receiving funds from decentralized liquidity pools.Elliptic traced 117,000 NEAR, worth $430,000, through six tokens in its November 9 analysis. Each cost approximately 25 NEAR, or $90, to create. The firm said transfers remained traceable despite the added transaction steps.How Disposable Tokens Hid the Origin of FundsBetween November 5 and 7, the laundering wallets launched six tokens on NEAR, Elliptic found. They paired each token with NEAR in a separate decentralized exchange liquidity pool.One set of wallets bought the tokens using stolen NEAR. Another sold those same tokens to recover NEAR, leaving no direct transfer between wallet groups.Elliptic said the pattern could make receiving wallets resemble profitable traders. Yet network data linked the buyers, sellers, and token creators to the same stolen funds.Five token creators received funding from wallets selling earlier tokens just two to thirteen minutes beforehand. Outside wallets bought less than 1% of one token’s trading volume. The other five had no outside buyers, according to Elliptic.All six tokens stopped trading by November 8. Four issuers withdrew remaining liquidity that afternoon. Elliptic identified approximately 11.8 million stolen NEAR still unmoved at its reported snapshot.Why Liquidity Pool Deposits Require Closer ChecksElliptic warned that funds emerging from liquidity pools should not automatically receive a clean classification. It identified recently created tokens, concentrated trading and single-purpose wallets as potential warning signs.The approach did not conceal every movement onchain. Instead, it created extra tracing work while stolen assets continued crossing networks.The firm documented a related tactic after the 2025 Bybit breach. At least $24 million passed through a worthless token on Tron, it reported. For Binance, Elliptic observed another homemade Tron token on November 2. The next day, attackers routed stolen SOL through existing thinly traded tokens.Binance Hack Investigation ContinuesThe FBI attributed the October 29 theft to North Korea’s TraderTraitor operation. Pyongyang has denied responsibility.As Blockonomi previously reported, attackers accessed Binance’s wallet infrastructure after compromising employee devices. A separate Blockonomi report covered the FBI’s attribution and early movement of stolen crypto.Binance said on November 3 the incident affected approximately $6.34 billion. It reported around $2.85 billion frozen or intercepted and 98% of affected assets replenished. Those replacements were funded by Binance, not recovered loot.The post North Korean Hackers Prompt DeFi Screening Warning appeared first on Blockonomi.