Binance drain, the NEAR leg: stolen funds were handed on by splitting into a "buyer" and a "seller" that traded six brand-new meme coins

1. What happened

On 29 October 2026, assets were drained from several of Binance's "hot wallets" (the online wallets an exchange uses for day-to-day withdrawals). On 31 October the FBI issued an alert attributing the attack to North Korea (FBI alert).

The losses span many chains. This article covers the NEAR part. On-chain, three accounts sent 12,410,067 NEAR in total to one account over seven minutes, from 20:15 to 20:22 UTC on 29 October.

By 9 November, about 786,000 NEAR had been sent out of that account. The remaining 11.62 million NEAR or so has not moved. The way the outgoing funds were moved was different from the other chains.

2. A few terms first

• Meme coin: A crypto asset traded on hype alone. Anyone can create a new token in a few minutes.
• DEX (decentralized exchange): An exchange with no operating company in the middle, where a program handles swaps automatically. On NEAR, Ref Finance is the best known.
• Pool: A shared box on a DEX that holds two crypto assets. With a pool of "new token" and "NEAR", you put one in and take the other out. Anyone can create a pool, too.
• Bridge: A way to move assets from one chain to another.
• Chainflip: A service for swapping crypto assets across chains. Each user gets a one-off deposit address; send funds there, and a different asset is paid out on a different chain.

3. The six tokens

The six tokens were created one after another with the same token-creation tool, and their names end in a running number from 3 to 8. All the pools are on Ref Finance, each paired with NEAR.

For every token, the issuing account created the pool itself and put in the starting funds (40 to 374 NEAR) on its own. The issuing account still holds 80% to 99.99% of the supply, and no token has more than 15 holders. That is a shape you almost never see in a genuinely popular token.

4. Following the money in order

1. Create the token and the pool. The issuer account creates a token and puts it into a pool together with a little NEAR. It also hands out the token free to the seller account.
2. Hand the stolen NEAR to the buyer accounts. About 117,000 NEAR went from the first receiving account to one account, and from there, through a distributor account, to the buyer accounts 100 NEAR at a time. There are 871 transfers of exactly 100 NEAR.
3. The buyer buys the token. With the NEAR it received, the buyer buys the token about 10 NEAR at a time. It never sends the tokens it bought anywhere; it just keeps them.
4. The seller sells straight away. Within tens of seconds to a few minutes of each buy, the seller sells almost the same amount of the token and receives NEAR. Because buys and sells alternate one for one, the pool's contents barely change.
5. The result: NEAR moves from the buyer to the seller. Across the six tokens, there were 2,559 buys totalling about 143,700 NEAR and 2,573 sells totalling about 143,100 NEAR. The gap of about 570 NEAR is trading fees.

閉じる / Close

There is not a single direct transfer between the buyer and the seller. All the records show are separate trades: "the buyer bought the token from the pool" and "the seller sold the token to the pool". As long as you do not mind being left holding a worthless token, you can pass money on in the form of trades.

The issuer did pull funds back out of the pool (a so-called rug pull) for four tokens on 8 November, but only 265 to 419 NEAR per token. Almost all of the money moved through the trades above.

5. Why following the attacker's accounts alone does not show this

Tracing stolen funds usually means following transfers out of the attacker's accounts one by one. That way, you can see as far as the buyer putting NEAR into the pool. Follow it further mechanically, and everyone who used the pool becomes a suspect.

So ChainAnalyzer turned the direction around.

1. Go through newly created pools on Ref Finance in order of their IDs.
2. Check who bought and who sold each pool's token.
3. Trace back where the buyers' NEAR came from.
4. Keep only those whose source leads back to an attacker account that has already been confirmed.

That is how the six tokens were found. We read all of the roughly 5,100 trades in the six pools and separated buyers from sellers; the result is the table in section 3.

6. What we found at the exit

• Some of the NEAR the seller received was swapped into USDC and sent to Ethereum through Aurora (a separate chain connected to NEAR) and a bridge. On 8 and 9 November, about 310,000 USDC in total went to three addresses (about 96,000 to 110,000 USDC each).
• The three addresses sent the USDC they received to Chainflip deposit addresses, not to exchange deposit addresses. We confirmed from the creator records that these addresses were created by Chainflip.
• We followed the Bitcoin that was paid out to 20 addresses. No deposits to exchanges have been found. Because the funds merge with other money along the way, we do not count the amounts beyond that point as belonging to this route.
• The exit addresses also received funds that came directly from the first receiving account without passing through the meme coins. We cannot say that all of the roughly 310,000 USDC went through the six tokens.

7. What we do not know yet

• Where all of the seller's NEAR went. We traced the largest recipients; the smaller amounts sent to many accounts have not been fully traced.
• The pools also received small trades from other accounts, under 1,000 NEAR in total. Whether these are part of the same operation or unrelated users is unknown.
• Whether the remaining 11.62 million NEAR or so will be moved the same way.

8. What ChainAnalyzer now follows

• Added to the incident record: The Ethereum landing addresses of this route have been added to the address list on the incident page. They are also reflected in matching by wallet scans, the REST API and MCP.
• Watching NEAR balances: We watch the balances of the attacker's NEAR accounts and record any movement.
• Detection from new pools (in preparation): We are preparing a system that runs this method continuously, so that we can tell early when the attacker's funds start buying a new token.

9. Closing: tracing hand-offs dressed up as "trades"

Anyone can create a meme coin and a pool in a few minutes. With a buyer and a seller in place, a transfer turns into a "trade", and the link between sender and receiver disappears from the records. What passed through the six tokens is about 1% of the funds that went to NEAR. The same method could be used on the remaining 11.62 million NEAR or so.

What those tracing the funds can do is not only follow transfers but also watch newly created places first.

The flow of funds on other chains in the same incident is covered in the articles on the XRP leg and the Solana leg.