Investigators tracing the $6.4 billion Binance hack uncovered two new developments on November 9, 2026. Blockchain intelligence firm Elliptic identified six attacker-created meme tokens used to launder approximately $430,000 in stolen NEAR, while a separate update traced roughly $15 million in ETH into Tornado Cash and $154 million in XRP moving through conversion routes. Today’s crypto crime roundup examines the new token-laundering technique, the expanding use of privacy services and the growing network of wallets linked to the October 29 theft.
Elliptic’s latest analysis covers more than 20,000 addresses across 16 blockchains and at least 65,000 transactions. Despite that activity, researchers estimate that approximately $3 billion remains in addresses connected to the original theft, with only a negligible amount believed to have been converted into spendable funds outside the blockchain ecosystem.
Binance hackers create six meme coins to launder stolen NEAR
Elliptic published a new investigation on November 9 identifying an unusual laundering method involving cryptocurrency tokens created specifically to move stolen funds between wallets without direct transfers.
Between November 5 and 7, the suspected North Korean operators created six tokens on the NEAR blockchain: FUK, OLCCL, MEILI, MMLI, DABI and SINU.
The first token, FUK, was created at 00:25 UTC on November 5. Four others appeared on November 6, between 07:19 and 14:27 UTC, while SINU was created at 10:06 UTC on November 7.
Each token cost approximately 25 NEAR, worth about $90, to create. Investigators found that the operators established liquidity pools pairing the new tokens with NEAR, then used wallets containing stolen cryptocurrency to purchase them.
Separate wallets subsequently sold those tokens back into the pools, receiving NEAR that could then be transferred elsewhere or converted into other assets.
The mechanism creates an additional layer between the original stolen funds and the wallets collecting the proceeds. A wallet selling newly minted tokens can appear to be conducting ordinary cryptocurrency trading, even when the assets originally funding the liquidity pool came from a theft.
The sum was modest against the overall theft, not the technique so much.
Elliptic traced approximately 117,000 NEAR, valued around $430,000, through the six tokens. Almost the same amount subsequently left the collecting wallets, with much of it converted into stablecoins or moved toward cross-chain bridges.
All six were short-lived, very short-lived in some cases.
None had traded since November 8, and the creators of four tokens withdrew remaining liquidity from their pools that afternoon.
Token funding patterns connect the laundering wallets
The November 9 investigation provides transaction-level evidence that the six tokens belonged to a coordinated laundering operation rather than unrelated speculative launches.
According to Elliptic, wallets linked to the stolen funds made every sale involving the six tokens and purchased every unit of five of them. FUK attracted a handful of outside purchases, but these represented less than 1% of its trading volume.
DABI, MMLI and SINU each had only one buying wallet and one selling wallet. The remaining tokens followed similarly concentrated trading patterns.
It is the funding trails, though, that tie the little tokens together.
Five of the six token creators recieved their funding from wallets that had previously sold an earlier token in the sequence. These transfers occurred between two and 13 minutes before the next token was created.
Every token began trading within three hours of its creation, and at least 75% of each token’s volume occurred within a single day.
The arrangement resembles a technique previously identified during the laundering of funds stolen from Bybit in February 2025. Elliptic estimated that North Korean operators moved at least $24 million through a specially created token and a liquidity pool on Tron following that attack.
The Binance attackers used a comparable approach on Tron on November 2, followed by transactions involving obscure existing tokens on Solana the next day. The six NEAR tokens provide a particularly detailed example of the method.
Earlier investigations also identified the use of decentralized lending protocols to complicate tracing. DaveFinances previously reported on the JustLend laundering route involving stolen Binance funds, where attackers used lending-market transactions and receipt tokens to move assets between wallets without straightforward direct transfers.
The newly identified meme-token strategy creates a different kind of separation. Rather than transferring a lending receipt, the operators manufacture a tradable asset and use its liquidity pool to move value between seperate wallets.
These transactions remain publicly recorded. Elliptic’s findings demonstrate that investigators can reconstruct the transfers by examining token creation, pool activity, wallet funding and subsequent swaps.
Tornado Cash receives $15 million as XRP laundering accelerates
A separate Elliptic investigation, updated at 13:15 UTC on November 9, identified approximately 7,000 ETH, worth $15 million, deposited into Tornado Cash from addresses connected to the Binance theft.
The deposits began November 8 and continued into November 9. Investigators counted approximately 100 deposits into Tornado Cash’s 10-ETH pool and another 60 deposits into its 100-ETH pool.
Some of the ETH reportedly originated from Bitcoin that had already passed through coinjoin transactions before being converted back into ETH through THORChain.
The movement represents another stage in the laundering of previously stolen assets, not an additional $15 million theft.
Bitcoin mixing activity also expanded. Elliptic estimates that approximately 130 BTC, worth $10 million, had entered Wasabi-style coinjoins by November 9, compared with roughly 88 BTC identified on November 7.
Meanwhile, XRP conversions continued despite a temporary interruption involving THORChain.
The protocol halted XRP trading on November 7, disrupting swaps linked to the attacker for almost a day. Some transactions began passing through again on the afternoon of November 8, despite the halt.
The halt slowed the route, but it didn’t end it, no.
By early afternoon on November 9, approximately 139 million XRP, worth $154 million, had left attacker-associated XRP addresses. Most of those tokens were swapped into Bitcoin, according to Elliptic.
Another 95 million XRP, valued around $105 million, remained in the identified wallets, with most concentrated in two addresses that had not moved since November 2.
Across the broader operation, investigators identified approximately 3,000 BTC, valued at $225 million, in newly created Bitcoin addresses after conversions from other stolen cryptocurrencies.
These figures describe overlapping stages of the same laundering operation. The $154 million in XRP movements, $225 million in converted Bitcoin and $15 million entering Tornado Cash should not be added together as independent losses or succesful cash-outs.
The latest activity extends earlier findings about asset movements through multiple blockchain networks. DaveFinances previously examined the Binance hacker’s $72 million in SOL transfers, including conversions through USDC, Ethereum and THORChain into Bitcoin.
More than 20,000 wallets linked to Binance laundering
Elliptic’s evolving investigation now covers more than 20,000 cryptocurrency addresses across 16 blockchain networks, at least 36 services and approximately 65,000 transactions.
The firm describes the activity as highly automated, citing recurring transaction amounts, rapid wallet creation and repeated transfers across different networks. It has not identified evidence demonstrating that autonomous AI agents are directing the transactions.
The FBI attributed the October 29 Binance attack to North Korea’s TraderTraitor operation on October 31, urging exchanges, blockchain infrastructure operators and other cryptocurrency businesses to block transactions involving identified attacker-associated addresses.
Elliptic estimates that approximately $2.85 billion of the original $6.43 billion theft has been frozen or seized, leaving roughly $3 billion in addresses associated with the attackers.
Most of the remaining assets are concentrated in Bitcoin and Ethereum holdings that have not moved since the initial stages of the incident.
The stolen funds have travelled through numerous services, but the evidence does not establish that most of their value has already been cashed out.
Investigators identified approximately $16 million transferred to addresses that also contain proceeds associated with the September 2026 Bitget exploit, another incident attributed to TraderTraitor. The shared destinations provide a transaction-level connection between the two investigations, although blockchain records alone cannot establish the identities of every intermediary handling the funds.
The laundering findings are seperate from Binance’s customer-asset recovery efforts. Following the October 29 breach, the exchange began restoring withdrawals on November 1 and reported that it had replaced approximately 95% of affected assets using corporate resources and protection funds. DaveFinances covered Binance’s phased withdrawal restart and asset replacement following the attack.
Replenishing customer reserves does not mean the stolen cryptocurrency has been recovered from the attackers, and the percentage of replaced assets cannot be combined with Elliptic’s frozen-funds estimate.
For exchanges and compliance providers, the newly documented technique introduces a specific screening challenge. Funds emerging from decentralized liquidity pools may have passed through newly created tokens controlled entirely by laundering wallets, making the most recent transaction an incomplete indicator of their origin.
Investigators can still follow the transaction history, but doing so requires examining the funding and trading activity behind the pool rather than treating its output as independant trading proceeds.
Elliptic’s November 9 findings establish that the laundering operation is expanding across more transaction routes while most of the original stolen value remains identifiable on-chain. The new meme tokens complicate tracing, and Tornado Cash introduces further obstacles, but neither development establishes that the attackers have converted the reported amounts into cash beyond the cryptocurrency system.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.