Elliptic says memecoins moved $430,000 from Binance hack

In a Nov. 9 report, Elliptic’s Tom Robinson said the operators minted FUK, OLCCL, MEILI, MMLI, DABI and SINU between Nov. 5 and 7. Creating each token cost about 25 NEAR, or $90. The operators paired them with NEAR in separate pools and routed roughly 117,000 stolen NEAR through those markets. Elliptic reported similar activity on Tron and a related Solana route using existing, thinly traded tokens.

One set of wallets bought the tokens with stolen cryptocurrency; another sold them into the same pools and collected the underlying assets. Because the wallets did not transfer funds directly to one another, incoming payments could appear to be trading profits. Elliptic cautioned compliance teams not to treat pool payouts as clean automatically. “The trail can still be followed on-chain,” the report said. The firm said the method had also been identified after the 2025 Bybit hack and was intended to slow investigators; the tokens could be discarded after use.

Elliptic’s tracker, updated Nov. 9 at 13:15 UTC, recorded more than 20,000 wallets across 16 blockchains, at least 36 services and 65,000 transactions. Since Nov. 8, wallets linked to the theft had sent roughly 7,000 ETH, worth $15 million, to Tornado Cash. Some of the deposits came from bitcoin that had passed through coinjoin transactions before being converted back to ETH.

The tracker said about 3,000 BTC, worth $225 million, had accumulated in new addresses after conversions from other stolen assets; the main Bitcoin and Ether holdings had not moved. Around $3 billion remained in theft-linked addresses and $2.85 billion was frozen. Elliptic estimated that only a negligible amount had likely been cashed out. The FBI attributed the theft to TraderTraitor on Oct. 31 and urged services, including THORChain operators, to block linked transactions.