According to Elliptic, at least six tokens were launched between November 5 and 7 and were subsequently suspended. These tokens include FUK, OLCCL, MEILI, MMLI, DABI, and SINU. Their visual designs featured a fox, a duck against the backdrop of the American flag, an emoji, a monkey wearing a pink ribbon, and a portrait of Musk with the caption “Elon 2028 President.” The launch of each of these assets cost approximately $90 (about 25 $NEAR). As of November 8, trading in all six of these tokens has ceased.
This strategy is designed to conceal the direct link between the wallet containing the stolen funds and the wallet into which they are transferred. The process is carried out through transactions in liquidity pools on decentralized platforms. First, a meme coin is purchased from the original wallet using the funds obtained through the theft. Afterward, another wallet sells this token in the same pool, converting it back into $NEAR. Experts at Elliptic explain that such tokens serve as a kind of container, since no one other than the fraudsters themselves buys them. As a result, the stolen funds enter one side of the liquidity pool and exit from the other. The absence of direct transactions between addresses allows these actions to be disguised as standard trading activity.
The low cost of creating such tokens and their abundance on the market allow them to blend in among the multitude of other meme coins. This helps attackers create new links in the transaction chain, complicating investigations. Analysts note that the hackers converted most of the $NEAR they received into stablecoins or used cross-chain bridges to transfer it. Notably, the amount of 117,000 $NEAR represents only a small fraction of what was stolen. The total amount of funds withdrawn reached approximately 11.8 million $NEAR, equivalent to $42.7 million, and this money was laundered using other methods.
This method of “laundering” cryptocurrency by creating temporary tokens is reminiscent of the incident involving the Bybit exchange in 2025, when approximately $24 million was transferred via an artificially created token.
The hack of the largest crypto platform occurred on the night of October 29–30. According to Binance’s estimates, the losses exceeded $6.3 billion. Blockchain analysts and the U.S. FBI managed to freeze about 44% of the stolen funds, and the attack itself was attributed to hackers from North Korea.