North Korean launderers mint throwaway meme coins to move Binance hack funds

North Korean launderers are minting their own worthless meme coins to move money stolen from Binance, according to a report blockchain analytics firm Elliptic published on Nov. 9.

The technique is simple. The launderers create a token nobody else wants, pair it with NEAR or a stablecoin in a liquidity pool on a decentralized exchange, pay stolen funds into the pool through one set of wallets to buy the token, then sell it back through a second set of wallets to withdraw clean-looking assets. Because the pool sits in the middle, no stolen funds move directly from the buying wallet to the collecting wallet, and the receiving wallets look like ordinary traders cashing out a meme coin.

Between Nov. 5 and 7 the operators created at least six tokens on NEAR, each in its own pool: FUK at 00:25 UTC on Nov. 5, then OLCCL, MEILI, MMLI and DABI on Nov. 6, and SINU on Nov. 7. Each cost about 25 NEAR, roughly $90, to create. Each token was traded heavily within hours using stolen NEAR and then abandoned. None has traded since Nov. 8, and the creators of four of them pulled the remaining liquidity that afternoon.

About 117,000 NEAR, or roughly $430,000, passed through the six tokens before much of it flowed into stablecoins or a cross-chain bridge, Elliptic said. The coins carried the usual meme-coin trappings: a monkey in a pink bow, a duck in front of a US flag, a chimpanzee, a fox, and an image of Elon Musk under an "Elon 2028 President" banner. Elliptic noted there is no suggestion Musk has any connection to the tokens.

Elliptic's data points to deliberate construction. Wallets in the laundering network made every sale of all six tokens and bought every unit of five of them. Five of the six token creators were funded by a wallet that had just sold an earlier token, between two and 13 minutes before the next launch, so the tokens form a chain with the proceeds of one paying for the next.

Decrypt reported that the amounts are small against the $6.4 billion stolen from Binance, of which Elliptic previously found more than $3 billion had yet to be laundered. About 11.8 million NEAR from the theft, worth $43.7 million, has still not moved, according to Elliptic.

The trick does not hide the funds. Every step is recorded on the blockchain, and investigators can follow it. "It does not hide the funds so much as slow down the people tracing them," Elliptic wrote. Tom Robinson, Elliptic's co-founder, said North Korea's launderers rarely rely on a single technique and instead layer many cheap ones, each adding delay.

Elliptic first saw the approach while tracing the $1.5 billion Bybit theft in 2025, also attributed to the TraderTraitor group behind the Binance breach, where a worthless token on Tron helped move at least $24 million. In the Binance case the firm has seen the same idea on Tron from Nov. 2, and a close variant on Solana a day later that used existing thinly traded tokens rather than homemade ones.

Bitcoin Magazine added wider numbers from Elliptic's update: roughly 3,000 BTC, about $225 million, sitting in new bitcoin addresses converted from other stolen assets, and more than 20,000 wallets touched across 16 blockchains. The FBI has attributed the theft to North Korea's TraderTraitor group, Bitcoin Magazine reported, and Binance has put the loss at $6.34 billion.

For compliance teams, the firm warned that funds arriving from a liquidity pool should not be treated as clean by default, particularly where freshly minted tokens and a handful of trading wallets are involved. Elliptic listed the warning signs it wants firms to check: a token created in the last few days, a pool where only a handful of wallets trade, wallets that only buy or only sell, and new wallets funded shortly before trading starts, often in round amounts. Elliptic maintains a public blocklist of wallets tied to the exploit, which it updates as it identifies new ones.