Six short-lived tokens
Elliptic's November 9 research identifies six tokens on NEAR, each paired with NEAR for trading. Activity ended after a series of swaps. The firm says none traded after November 8 and that the creators of four tokens subsequently withdrew pool liquidity.
The roughly 117,000 NEAR figure describes funds routed through this particular sequence. Its approximate $430,000 value is a rate-dependent snapshot, not an additional loss to add to the hack total: the assets had already been stolen.
The path through the pools
The operators first created a token and a pool pairing it with NEAR. One set of wallets bought that token using NEAR Elliptic links to the theft. A second set sold the tokens into the pool and received NEAR. Two swaps therefore stood between the entering and exiting wallets in place of a direct transfer.
The pool changed the transaction path, not the public history of the assets. Investigators can still examine token creation, the source of the NEAR, purchases and subsequent sales. Using a decentralized exchange does not itself implicate the exchange in wrongdoing.
The links between successive launches
Elliptic found that five of the six token creators were funded with proceeds from a previous token in the sequence just 2 to 13 minutes before the next launch. Its analysis says trading was concentrated among wallets in the same network rather than independent outside traders. That pattern, together with the traced source of the NEAR, connects the separate pools.
Elliptic attributes the activity to North Korean hackers. The published transaction pattern alone is not a legal finding about the operators' identities. The report does not identify a NEAR protocol vulnerability or accuse the token-launch tools or trading venue of participating in the theft.
Scale and what tracing requires
At the time of Elliptic's analysis, about 11.8 million NEAR, then valued at $43.7 million, remained unmoved in wallets the firm links to the theft. That was a point-in-time observation, not a live balance. The meme-token route represented only a small part of the assets involved in the broader Binance incident.
Tracing such flows means looking beyond direct transfers between known addresses. The relevant evidence includes where the base asset came from, when each token and pool appeared, who traded in it and which wallets collected NEAR on the way out. Intermediate swaps complicate the path but do not erase an onchain record.
