North Korean Hackers Mint Custom Meme Coins to Launder Stolen Binance Funds

According to blockchain analytics firm Elliptic, North Korean state-backed hackers are creating custom, low-value meme coins to obscure the trail of stolen funds from the Binance exchange hack. By routing the stolen cryptocurrency through these newly minted tokens, the launderers ensure that the illicit assets never transfer directly between wallets, complicating forensic tracking.

Between November 5 and November 7, the threat actors minted at least six new tokens on the NEAR blockchain, named FUK, OLCCL, MEILI, MMLI, DABI, and SINU. Each token was paired with NEAR in a dedicated liquidity pool. The operators purchased these tokens using stolen NEAR and subsequently sold them through a separate set of wallets. Elliptic reported that approximately 117,000 NEAR, valued at roughly $430,000 at the time, flowed through this six-token network.

This activity is part of the broader money-laundering operation following the October 29 Binance theft, which the exchange valued at $6.34 billion and the FBI attributed to North Korea’s TraderTraitor group. In an updated assessment, Elliptic revealed that approximately 3,000 BTC (worth about $225 million) has been moved to new Bitcoin addresses after converting other stolen assets. Meanwhile, roughly 11.8 million NEAR, valued at $43.7 million, remains untouched.

Elliptic co-founder and chief scientist Dr. Tom Robinson noted, “While most people view meme tokens as speculative joke coins driven by market hype, North Korean launderers have repurposed them as sophisticated tools for concealing the movement of stolen assets.”

The Mechanics of the Homemade Token Laundering

The laundering process relies on a four-step transaction hop. First, the operators create a token using a public launch tool and establish a liquidity pool pairing it with a legitimate asset like NEAR or a stablecoin. Second, they purchase the newly minted token using stolen funds from one group of wallets. Third, they sell the token back into the liquidity pool. Finally, a separate set of wallets collects the real asset from the pool. This separation ensures that the stolen funds do not directly link the initial theft to the final destination.

Because the liquidity pool acts as an intermediary, the stolen funds never transfer directly from the buying wallets to the collecting wallets. To a casual blockchain observer, the wallets collecting the real assets appear to be standard traders capitalizing on market opportunities by selling a token for a profit.

Each of the six NEAR tokens cost approximately 25 NEAR (around $90) to mint. All six tokens experienced heavy trading within hours of their creation using stolen NEAR, after which they were abandoned. None of the tokens have seen activity since November 8, and on that afternoon, the creators of four of the tokens withdrew the remaining liquidity. Further analysis revealed that five of the six token creators were funded by a wallet that had liquidated an earlier token just two to 13 minutes before the subsequent launch, establishing a sequential chain of token creation.

Elliptic previously documented this identical laundering methodology in the February 2025 Bybit theft, also attributed to the TraderTraitor group, where a valueless Tron token facilitated the movement of at least $24 million. In the Binance hack case, Elliptic has observed the same technique on the Tron blockchain, as well as a variant on Solana that utilized pre-existing, thinly traded tokens instead of newly minted ones.

A Tactical Delay Rather Than Anonymity

These meme coins do not inherently hide the illicit funds, as every transaction step remains publicly visible on the blockchain. Instead, the primary utility of this tactic is to buy time. Each additional hop in the transaction chain delays investigators, allowing the launderers to move assets rapidly before compliance systems or blocklists flag the addresses. At a creation cost of roughly $90 per token, the strategy is highly cost-effective, allowing the operators to discard the tokens once their purpose is served.

This technique aligns with the extensive laundering network Elliptic has tracked since the initial breach, which spans over 20,000 wallets across 16 blockchains, involves at least 36 services, and encompasses more than 65,000 transactions. Binance disclosed that the attack originated from a fake job interview and persisted for five months before any funds were moved. However, blockchain analysis firms successfully linked the breach to the TraderTraitor group within a single day.

The conversion of stolen assets into Bitcoin represents the most significant financial development. All of the stolen Solana (SOL) has already been swapped, bridged, or mixed, and a substantial portion of the stolen XRP has also been funneled into Bitcoin. Approximately $2.85 billion of the original stolen amount has been frozen by exchanges. According to Elliptic, only a negligible amount of the funds has likely been cashed out into fiat currency so far.

North Korea’s cryptocurrency theft operations are well-established. Elliptic estimates that the regime’s total stolen haul for 2025 exceeds $2 billion, heavily driven by the $1.46 billion Bybit exploit. This figure brings the regime’s cumulative known theft total to over $6 billion, even excluding the recent Binance breach.

Binance has gradually resumed withdrawals, stating that it has covered customer losses using its own reserves. Looking forward, the primary challenge for investigators will be determining whether these custom liquidity pools can be created and deployed faster than blockchain analytics blocklists can identify and isolate them.

Source link