According to CoinMeta, and as reported by blockchain analysis firm Elliptic, the Anbin hackers are using their own meme coin and decentralized exchange liquidity pools to transfer stolen funds. This tactic has been observed on the Tron, NEAR, and Solana networks. Specifically, the hackers first create new tokens and pair them with assets such as NEAR or stablecoins to establish liquidity pools. They then execute buy and sell operations through different wallets, making the fund transfers appear to be ordinary token transactions, thereby increasing the difficulty of tracking on the blockchain. Elliptic indicates that from November 5th to 7th, the hackers created at least 6 meme coins on the NEAR chain, with each creation costing about 25 NEAR. In total, they transferred approximately 117,000 NEAR stolen funds through these tokens, worth about $430,000. Trading of these related tokens ceased on November 8th, and there are still about 11.8 million NEAR stolen funds remaining unmovable, valued at around $43.7 million. Elliptic emphasizes that this tactic cannot truly hide the flow of funds on the chain; its main purpose is to delay the investigation process.