Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

TraderTraitor-linked wallets launder Binance theft via fake NEAR tokens

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Elliptic says TraderTraitor-linked wallets moved about 117,000 NEAR through six disposable tokens after the October 29 Binance theft.

Elliptic says North Korean operators linked to TraderTraitor used worthless tokens and decentralized-exchange liquidity pools to make stolen Binance assets look like ordinary sales. The FBI attributed the October 29, 2026 drain across 11 blockchains to TraderTraitor, which Elliptic places in a reported $6.43 billion theft. About 117,000 NEAR, roughly $430,000, moved through six short-lived NEAR tokens from November 5 to 7; laundering wallets made every sale and nearly all purchases. The tokens were abandoned by November 8. By November 9, Elliptic said the wider operation spanned more than 20,000 wallets and 16 blockchains, with a similar pattern on Tron, NEAR and Solana.

Key facts
  • Six tokens—FUK, OLCCL, MEILI, MMLI, DABI and SINU—each cost about 25 NEAR, or $90, to launch.
  • Outside buying was under 1% of FUK volume; five tokens had no outside buyers.
  • Controlled wallets made every sale and bought every unit of five tokens.
  • By November 9 the wider operation covered more than 20,000 wallets and 16 blockchains.
  • The same liquidity-pool pattern appeared on Tron, NEAR and Solana, and records remain reconstructable.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 29, 2026FBI attributes Binance wallet drain across 11 chains to TraderTraitor · GBHackers
  2. Nov 5, 2026Laundering through six new NEAR tokens begins · Cyber Security News
  3. Nov 7, 2026About 117,000 NEAR finishes moving through the six tokens · GBHackers
  4. Nov 8, 2026The six disposable NEAR tokens are abandoned · Cyber Security News
  5. Nov 9, 2026Wider operation spans over 20,000 wallets and 16 blockchains · GBHackers

What each outlet adds

beyond the shared facts
  • GBHackersFBI attribution, 11-chain drain, and November 9 wallet and chain counts.
  • Cyber Security NewsToken names, outside-buyer share, and November 8 abandonment.
Vendors
Binance
Threat actors
TraderTraitor
Victims
Binance
Organizations
EllipticFBI
Countries
North Korea

Coverage

oldest first · one row per article · UTC
  1. · 1d ago GBHackersFirst report

    North Korea launders stolen Binance crypto via fake DeFi tokens

    About 117,000 NEAR, valued at $430,000, moved through six disposable NEAR tokens from November 5 to 7.

  2. · 1d ago Cyber Security News

    North Korean hackers launder Binance theft through fake meme coins

    Elliptic says about 117,000 NEAR, roughly $430,000, passed through six short-lived tokens in early November.