North Korean hackers mint memecoins to launder Binance loot, Elliptic says

Wallets tied to the $6.3 billion theft from Binance created at least six of their own memecoins on the NEAR blockchain between Nov. 5 and Nov. 7 and moved about 117,000 NEAR, roughly $430,000, through them, according to an analysis by blockchain analytics firm Elliptic that Cointelegraph reported. The tokens drew almost no outside trading and were dropped soon after launch.

Each token was paired with NEAR in its own liquidity pool on a decentralized exchange, the AltcoinBuzz report said. One set of wallets bought the memecoins with stolen NEAR, then a second set sold the same tokens back into the pools for NEAR. The arrangement let the money move without a direct wallet-to-wallet transfer while the transactions stayed visible onchain. Creating each token cost about 25 NEAR, or roughly $90.

The six tokens followed a tight schedule. FUK went live at 00:25 UTC on Nov. 5; OLCCL, MEILI, MMLI and DABI followed on Nov. 6 between 07:19 and 14:27 UTC; SINU was created at 10:06 UTC on Nov. 7, according to AltcoinBuzz. Their logos ranged from a chimpanzee and a fox to an image of Elon Musk under an "Elon 2028 President" banner, and Elliptic said Musk has no connection to any of them. None of the six has traded since Nov. 8, when the creators of four of them pulled the liquidity left in their pools.

Trading never came from outside the operation. Elliptic found that wallets in the network made every sale of all six tokens and bought every unit of five of them. The only outside activity was a handful of small FUK purchases on its first day, less than 1% of its volume. Cointelegraph also reported that five of the six token creators were funded with proceeds from an earlier token sale two to 13 minutes before the next launch, tying the tokens into one chain of transactions.

The buying wallets were funded with stolen NEAR passed down from a main stolen-funds wallet through intermediate accounts, AltcoinBuzz reported. Almost exactly the same amount, about 117,000 NEAR, left those collecting wallets soon afterward, with much of it converted into stablecoins or sent to a cross-chain bridge.

"North Korea's launderers rarely rely on a single technique," Elliptic co-founder and chief scientist Tom Robinson wrote in the report, quoted by Cointelegraph. "Instead, they layer many cheap techniques, each adding a little more delay."

The approach is not new. Elliptic said the same method followed the $1.5 billion Bybit hack in 2025, when North Korean-linked actors moved at least $24 million through a freshly created token on the TRON network. The firm also traced variants on other chains in the Binance case: it identified a worthless token on Tron built only to launder funds on Nov. 2, and on Nov. 3 watched stolen SOL swapped into wrapped, thinly traded tokens on Solana before being sold for USDC and moved to other blockchains, the report said.

The memecoin route is a small slice of the haul. Elliptic said about 11.8 million NEAR from the theft, worth $43.7 million, had not moved at the time of its analysis, and the six tokens handled less than 1% of that pile. Across the whole laundering campaign since the October theft, the firm counts more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions, with funds spread over 11 different blockchains after the Oct. 29 breach.

The FBI has blamed North Korea for the theft, saying more than $6 billion in virtual assets was taken from Binance on or about Oct. 29 in activity it calls TraderTraitor, while Elliptic puts the figure at $6.43 billion, AltcoinBuzz reported. Along with the US Secret Service and IRS Criminal Investigation, the bureau said it has observed TraderTraitor actors converting stolen assets mainly into Ether, and asked THORNode operators, RPC node providers, instant exchanges, DeFi services and analytics firms to block the addresses in question. Elliptic maintains a public blocklist of those addresses and updates it as new ones appear, which means deposits a firm has already accepted need to be checked again.