North Korean hackers behind the $6.3 billion Binance theft have created their own memecoins to disguise part of the stolen cryptocurrency, using fake trading activity to make illicit funds appear as legitimate market proceeds.
The attackers moved approximately 117,000 NEAR tokens, worth $430,000, through six newly created memecoins between November 5 and 7, according to blockchain analytics firm Elliptic. The scheme involved trading tokens between wallets under their control rather than transferring stolen assets directly, adding complexity to efforts to trace the funds.
Six memecoins used in laundering scheme
Elliptic identified six tokens: FUK, OLCCL, MEILI, MMLI, DABI and SINU. Their names and designs followed typical memecoin trends, featuring animals, internet humor and speculative themes. One displayed an image of Elon Musk beneath an “Elon 2028 President” banner, although Elliptic found no evidence of Musk’s involvement.
The hackers created separate liquidity pools for each token, pairing them with NEAR on decentralized exchanges (DEXs). One group of wallets used stolen NEAR to purchase the memecoins, while another sold those same tokens to receive NEAR in return.
By routing transactions through liquidity pools, the attackers avoided direct transfers between the wallets. The resulting transactions appeared to be trading proceeds rather than movements of stolen funds.
“The launderers made six of these crypto tokens, and traded them only with themselves. That makes the stolen funds look like trading proceeds,” Elliptic co-founder and chief scientist Tom Robinson told CoinDesk.
Almost all trading volume came from wallets linked to the laundering operation, with outside buyers accounting for less than 1% of one token’s volume. Activity stopped by November 8, after which the attackers withdrew liquidity from four pools. Each token reportedly cost only around 25 NEAR, or $90, to create.
North Korean Hackers Use Memecoins to Launder Funds From $6.3 Billion Binance Hack (Source: X)
Laundering extends across multiple blockchains
The NEAR operation is part of a broader strategy. Elliptic also identified similar techniques on TRON and Solana.
On TRON, the attackers created a token and paired it with a stablecoin to generate artificial trades. On Solana, they moved stolen SOL through low-liquidity tokens before converting the assets into USDC and transferring them across different blockchains. Unlike the NEAR and TRON tokens, the Solana tokens already existed.
The approach has precedent. Following the February 2025 Bybit hack, North Korean-linked hackers used a similar method on TRON, creating a worthless token and trading it against a stablecoin through controlled wallets. Elliptic estimated that at least $24 million in stolen funds passed through that arrangement.
Although these transactions make investigations more complicated, they do not erase the blockchain trail. Investigators can still examine liquidity pools and wallet activity, but additional transactions make it harder and more time-consuming to establish connections between addresses.
How the self-made memecoin scheme works. (Source: Elliptic)
More than $3 billion remains linked to the theft
The laundering operation has involved more than just memecoins. In its November 9 update, Elliptic reported that the attackers had used over 20,000 wallets across 16 blockchains, interacted with at least 36 services and conducted more than 65,000 transactions.
The hackers have combined cross-chain bridges, decentralized exchanges, lending protocols and mixing services to move the stolen assets.
Bitcoin has emerged as a major destination because, unlike USDT and USDC, it cannot be frozen by a central issuer. By November 9, approximately 3,000 BTC, worth $225 million, had been converted from other stolen assets and moved into new Bitcoin addresses.
The attackers also used CoinJoin transactions, which combine funds from multiple users to obscure the links between incoming and outgoing Bitcoin. Around 130 BTC, worth approximately $10 million, had passed through these transactions by November 9.
Another route involved Tornado Cash. Since November 8, the attackers had deposited approximately 7,000 ETH, worth around $15 million, into the mixing protocol.
Despite the extensive movements, Elliptic estimated that approximately $3 billion remained in addresses linked to the theft, primarily in Bitcoin and Ethereum holdings that had not yet moved. Around $2.85 billion had been frozen or seized.
FBI links Binance attack to North Korea’s TraderTraitor
The FBI has attributed the October 29 Binance theft to TraderTraitor, a hacking group linked to North Korea. The agency published addresses associated with the operation and urged cryptocurrency platforms, DeFi protocols, bridge operators and other service providers to block related transactions.
The attackers have continued shifting between networks as individual routes face restrictions. THORChain, which has facilitated conversions of stolen assets into Bitcoin, temporarily halted certain swaps during the laundering campaign, prompting the hackers to explore alternative routes.
The case highlights the growing challenges facing cryptocurrency compliance teams. Monitoring direct wallet transfers is no longer sufficient when stolen assets can move through liquidity pools, lending protocols and cross-chain services.
Elliptic has published a list of addresses linked to the theft to help businesses screen suspicious transactions. The firm also warns against automatically treating funds received through decentralized liquidity pools as legitimate trading proceeds, particularly when newly created tokens and concentrated trading activity are involved.
The use of self-created memecoins illustrates how hackers can manufacture artificial market activity to disguise illicit funds. While the technique does not eliminate transaction records, it adds another layer to an already complex laundering operation involving billions of dollars in stolen cryptocurrency.
