OAK — OnChain Attack Knowledge

Technique · OAK-T7.011 · observed

OAK-T7.011 — Self-Minted Token Pool Laundering

Parent Tactics
OAK-T7 (Laundering)
Adjacent Techniques
OAK-T7.004 (NFT Wash-Laundering: the same self-dealing idea using NFT sales instead of a fungible-token pool), OAK-T7.007 (DEX Aggregator Routing Laundering: launders through existing liquidity, whereas T7.011 makes the token and the pool itself), OAK-T7.003 (Cross-Chain Bridge Laundering: usually the next hop after the pool)
Maturity
observed
Chains
NEAR, Tron and Solana (observed); any chain with permissionless token creation and AMM pools
First documented
2025 (Bybit proceeds on Tron, per Elliptic); 2026-11 (Binance proceeds on NEAR, traced by OAK)
Aliases
"meme-coin mixer", "home-made token laundering", "pool-as-mixer"

Description

The launderer mints a worthless token and pairs it with a liquid asset in a new AMM pool that they control. They then put stolen funds into the pool from one set of wallets by buying the token, and take them out to a second set of wallets by selling it. No transfer connects the two sets: each side only touches the pool contract. When it is done, the creator withdraws the remaining liquidity and the token is abandoned.

To a tracer, the pool looks like a counterparty that pays out to anyone, much as a mixer does. Unlike a mixer, though, nobody else is trading in it. Almost all the volume comes from the launderer's own wallets, and the token lives for hours or days, so the "crowd" a mixer would provide is missing. The method is cheap: a token costs about 25 NEAR (~$90) through a token-factory service.

A close variant, seen on Solana with the Binance proceeds, swaps through existing thinly traded tokens instead of new ones (Elliptic). If the token was not made by the launderer, file it under T7.007.

Observed indicators

  • A token created by a wallet that was funded minutes earlier by a wallet holding illicit proceeds. With the Binance proceeds the last funding transfer came between 1.5 minutes (FUK) and 13 minutes (SINU) before create_token.
  • Creation, pool registration and initial liquidity in one quick sequence: the token, then add_simple_pool, then wrapping the base asset and depositing liquidity, all within about half an hour.
  • Very few distinct traders. Elliptic found DABI, MMLI and SINU each had exactly one buying wallet and one selling wallet, and outside trading in FUK was under 1% of volume on its first day.
  • A chain of tokens: the wallet that sold the previous token funds the creator of the next one, often minutes before launch. Elliptic counted five of six NEAR creators funded this way; OAK found the MMLI creator funded directly by the MEILI creator.
  • A short life. Each token is first sold within about 3 hours of launch, and most of its trading happens within one day; afterwards the creator pulls the liquidity.
  • Ticker and branding that copy current meme themes (an "Elon 2028 President" banner on the NEAR set). Elliptic says there is no suggestion Musk is connected.

Detection signals

  • Creator-funding taint. For every new token, take the creator's funding transactions in the hour before creation; alert when the funder is on a hack blocklist, or is one hop away from it.
  • Pool participant concentration. For a pool under 7 days old, count distinct buying and selling wallets; alert when a handful of wallets make up almost all the volume, or when wallets only buy or only sell.
  • Pool-out taint for exchanges. Do not treat funds that come out of a DEX pool as clean by default. For a deposit whose last hop is a sale of a token under a week old, check whom the pool's other traders and the token creator were funded by.
  • Retroactive rescreening. Elliptic's Binance blocklist grew from 2,598 addresses (2026-10-31) to 22,223 (2026-11-10). Deposits accepted before a label existed need to be re-screened when the list grows.

Real-world examples

  • Binance hot-wallet hack proceeds, NEAR, 2026-11-05 → 11-08 (traced by OAK). Six tokens were created through the smithii.near token factory and paired with wNEAR on Ref Finance (v2.ref-finance.near): FUK, OLCCL, MEILI, MMLI, DABI and SINU, in pools 9005, 9008, 9009, 9011, 9012 and 9013. Four creators were funded directly by NEAR accounts on Elliptic's Binance blocklist. About 117,000 NEAR passed through (Elliptic). See examples/2026-10-binance-devops-laptop-service-container-hot-wallet-drain.md for the full table of creators, tokens and transactions. [ellipticmeme2026]
  • Binance proceeds, Tron, 2026-11-02. Elliptic identified a worthless Tron token created only for laundering. OAK has not identified its address. [ellipticmeme2026]
  • Bybit proceeds, Tron, 2025. Elliptic reports the first use of the method: a worthless token paired with a stablecoin, with at least $24M moved through it. OAK has not traced this case. [ellipticmeme2026]

Reference implementations

  • No public detector at v0.1. The signals above can be computed from public indexer data (token creation, pool events and funding transactions); OAK found the NEAR set with a Ref Finance pool listing, ft_metadata calls over public RPC, and nearblocks.io account histories.
  • Vendor coverage: Elliptic labels the addresses involved on its public Binance blocklist; the token contracts themselves are not on it.

Mitigations

  • OAK-M43 (KYT operational practice): exchanges score deposits whose source is a young, low-participant pool as high risk, and rescreen past deposits when a hack blocklist grows. It would have flagged sales of the six NEAR tokens before deposit, because each creator's funder was a listed Binance-hack account or the previous creator.
  • OAK-M04 (Funder-graph clustering): cluster a token's creator with its funder and with the buyers and sellers of the pool. In the NEAR set this ties all six tokens to one operator.
  • OAK-M07 (Cross-chain attribution graph): follow the base asset out of the pool and across the next bridge, since the pool is normally one hop before a cross-chain move.

Citations

  • [ellipticmeme2026] — Elliptic (T. Robinson), "North Korea is minting meme coins to launder the Binance hack" (2026-11-09).
  • [ellipticblocklist2026] — Elliptic, Binance hack 2026 blocklist (downloaded 2026-10-31 and 2026-11-10).

Discussion

T7.011 is separate from T7.007 because the defender's control is different. Aggregator routing hides funds among real trades in deep liquidity, so a defender has to model route complexity. A self-minted pool has no real liquidity and no real traders, so the defender only needs to check who funded the creator and who trades in the pool. The pool's young age and its few participants are exactly what give it away.

False positives. Many legitimate meme tokens also launch through factories, have few traders on day one, and are abandoned. What sets the laundering case apart is the funding: the creator's money comes from a tainted source, and the buyers and sellers are the same cluster. Alerts based only on young age and low participation will be noisy.

Parent Tactics

Worked examples (1)