The hackers moved stolen $NEAR into one set of wallets, then used those funds to pay into different liquidity pools and receive the newly minted memecoins in return. A different set of wallets sold the memecoins back into the liquidity pools and withdrew real crypto assets.

Tom Robinson, Elliptic’s chief scientist and co-founder, notes the hackers’ moves are still trackable on blockchains.
“It does not hide the funds so much as slow down the people tracing them. Each extra hop takes time to unpick, and laundering is a race to move funds before they are flagged. The tokens are also cheap, at about $90 each on $NEAR, so the launderers can make many of them and discard each one after use.
North Korea’s launderers rarely rely on a single technique. Instead, they layer many cheap techniques, each adding a little more delay. Home-made meme tokens are simply one more layer.”
The hackers also used the same technique on the Tron (TRX) blockchain, and a similar one on Solana (SOL) with preexisting but thinly traded tokens.
The analytics firm Chainalysis attributes the record-setting hack to the North Korean cybercrime group TraderTraitor, which is believed to operate under the umbrella of the state-sponsored hacking outfit known as the Lazarus Group.