Binance hackers use six homemade coins to hide stolen funds
Why it matters
For compliance teams, this trick makes stolen money look like ordinary trading. Screening that only flags known bad wallets can miss it, so funds that pass through brand-new tokens deserve a closer look.
Post to XThe short version
On 9 November, blockchain tracking firm Elliptic said the hackers behind the Binance theft created at least six new digital coins between 5 and 7 November and pushed about $430,000 of stolen money through them. Buying and selling these coins between their own accounts makes the stolen money look like normal trading.
Here's what happened. Elliptic, which traces crypto payments, says the group behind last month's Binance hack has started making its own throwaway coins to clean stolen funds. Elliptic links the theft to TraderTraitor, a North Korean hacking group.
The trick works like this. One set of wallets pays stolen NEAR coins into a trading pool for a new coin, and another set sells back into it. In Elliptic's words, the collecting wallets "look like ordinary traders". Each coin cost about $90 to create, and all were abandoned within days, according to Elliptic.
So far only about $430,000 has gone through this route. Much more is waiting. Around 11.8 million NEAR, worth about $43.7m, has not moved yet, Elliptic said. Much of what did move was swapped into stablecoins or sent across to other blockchains, The Block said.
Put it in context. Elliptic says the same group used this method after the 2025 Bybit hack, moving at least $24m. Elliptic had earlier tracked about $124m of the Binance haul being turned into bitcoin, The Block reported.
Where this comes from
Written with AI from the sources above and checked against them before publishing. Here's how we work. This is news, not financial advice. Spotted a mistake? Tell us.
More on custody
- 10 November 2026Solana plans to scrap the feature used in Drift's $270m hack
- 9 November 2026Keplr login flaw lets thief drain $6m from 44,000+ wallets
- 9 November 2026Gnosis Pay breach leaks card numbers and addresses of crypto users
- 6 November 2026Standard Chartered and SBI invest in crypto theft insurer Soter