How a Crypto Wallet Can Look Profitable Without Making Money
Six NEAR meme coins let wallets linked to the Binance hack cash out about $430,000 in sales, yet the operation behind them earned nothing from the trades.
Key Takeaways
- About 117,000 NEAR entered; nearly the same left.
- Outside buyers made under 1% of FUK’s volume.
- Each token cost about $90 to create.
- About 11.8 million stolen NEAR remains unmoved.
Blockchain analytics firm Elliptic followed the money through the six tokens in a November 9 investigation, its latest report on the theft from Binance.
About $6.4 billion left Binance wallets on October 29, and two days later the FBI attributed the attack to North Korea under the TraderTraitor designation it also used for the 2025 Bybit theft. Coindoo already covered the self-minted TRON token traced by TRM Labs, where a liquidity pool was the only thing connecting buyer and seller. Elliptic’s NEAR findings put a number on both sides of the pool, across six tokens on a second blockchain.
Six tokens with almost no outside traders
Each token was paired with NEAR in its own pool on a decentralized exchange and cost about 25 NEAR, or roughly $90, to create. At that price a token can be used once and dropped, which is what happened to all six.
Launch times (UTC) and who traded
Nov 5, 00:25
The only token any outsider bought
Nov 6, 07:19–14:27 window
Network wallets on both sides
Nov 7, 10:06
One buyer wallet, one seller wallet
A brand-new token with a few dominant wallets is not evidence of laundering on its own. Many legitimate launches start that way, with the creator and a small group of early buyers doing most of the trading. Elliptic’s case rests on three findings that only make sense together.
The first is who traded. Wallets in the laundering network made every sale of all six tokens and bought every unit of five of them. Purchases from outside the network came down to a handful of small FUK buys on its first day.
The second is how each token was paid for. Five of the six creators were funded by a wallet that had already been selling an earlier token, between 2 and 13 minutes before the new launch. One token’s proceeds paid for the next, so the six form a chain rather than six separate bets.
The third is how briefly each token lived. Every one was first sold within three hours of launch and did at least three quarters of its trading inside a single day. None has traded since November 8, and that afternoon the creators of four tokens withdrew the liquidity left in their pools.
The figures here are Elliptic’s. Coindoo has not independently reproduced the six pools’ transaction records.
Why the sellers look like winners
Nothing about the tokens’ branding stood out. Elliptic describes logos in standard meme coin style, from a monkey in a pink bow and a duck in front of a US flag to an “Elon 2028 President” banner over an image of Elon Musk, whom Elliptic does not connect to the tokens. The names follow the same habit: FUK is a crude joke, and SINU borrows the “-INU” ending of dog-themed coins.
The wallets carried random names assigned by a popular wallet app, so their labels linked nothing either. Thousands of new tokens appear every day, which is the cover. In Elliptic’s reading, a wallet trading a fresh meme coin passes for a speculator unless someone checks where its money came from.
That check is where the profit disappears. The buying wallets were funded with about 117,000 NEAR, passed down from the main wallet holding stolen NEAR through intermediate accounts. Almost exactly the same amount then left the collecting wallets, much of it swapped into stablecoins or sent to a cross-chain bridge. At prices when Elliptic published, that came to roughly $430,000.
Read one collecting wallet at a time, the record is a run of clean exits: tokens sold, NEAR received. Read across the network, the same NEAR went around once and came back, minus about $540 in creation fees plus network costs. The only money that arrived from outside was the small FUK buying on day one.
A wallet’s profit figure compares what it received with what it paid. It cannot show that the buyers on the other side were funded from the same stolen wallet. And if a seller received its tokens by transfer instead of buying them in the pool, there may be no purchase price to subtract at all.
Why launderers use a trick investigators can follow
Every step sits on a public blockchain, and Elliptic followed it. According to the firm, the aim is delay rather than concealment. Each extra hop takes investigators time to unpick, and laundering is a race to move funds before they are flagged. At about $90 a token, the launderers can afford to make many and throw each one away.
The playbook is not new. Elliptic first saw home-made tokens in the laundering of the Bybit theft in 2025, when at least $24 million moved through a worthless TRON token. In the Binance case, it identified a similar TRON token on November 2. A day later it saw stolen SOL routed through thinly traded existing tokens on Solana before being sold for USDC and bridged out. TRM Labs described the same TRON pattern in its own tracing.
The NEAR sums are small next to what remains. About 11.8 million NEAR, worth roughly $43.7 million, had not moved as of Elliptic’s report, and the firm argues the technique is cheap enough to carry far larger amounts. Elliptic also stresses that the launch tool, the exchange and the wallet app did nothing wrong. The launderers used them the way any other user could.
Five checks before trusting a wallet’s winning streak
Wallet trackers and copy-trading feeds surface accounts with large realized gains. Elliptic’s warning signs for compliance teams carry over directly, and a block explorer is enough to run them.
01
Token age. Check when the token contract was created. Big sells within days of launch deserve a closer look.
02
Trader count. Open the pool’s trade history. A handful of wallets doing nearly all the volume means few real counterparties.
03
One-way wallets. Look for wallets that only buy alongside wallets that only sell. That split is one of Elliptic’s red flags.
04
Fresh funding. Trace the first deposit into the main buyers. New wallets funded just before trading, often in round amounts, are a warning sign.
05
Liquidity pulled. See whether the creator withdrew what was left in the pool soon after trading stopped.
A single flag describes much of the meme coin market. Several on the same wallet mean its profit figure needs the buyers’ side of the ledger before anyone copies its trades.
For exchanges, Elliptic’s advice is that funds arriving from a liquidity pool should not be treated as clean by default. Its public blocklist of wallets tied to the Binance hack grows as new addresses are identified, so a deposit that passed screening on arrival can be flagged later. Elliptic tells firms to recheck deposits they have already accepted each time the list is updated.
Alex is Editor-in-Chief of Coindoo and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
