North Korean hackers use homemade memecoins to launder Binance hack loot, Elliptic says
Hackers tied to North Korea created disposable memecoins—including an Elon Musk-themed token—to launder stolen funds from the massive Binance hack through decentralized liquidity pools, according to Elliptic.
North Korea-linked hackers behind the multibillion-dollar theft from cryptocurrency exchange Binance have turned to self-created memecoins to launder stolen funds, according to blockchain analytics firm Elliptic. Between Nov. 5 and Nov. 7, the perpetrators minted at least six throwaway tokens on the NEAR blockchain network, spending approximately $90 (about 25 NEAR) per launch to route roughly 117,000 NEAR, worth around $430,000, through decentralized exchange liquidity pools.[7][1][2][6]
The tokens—named FUK, OLCCL, MEILI, MMLI, DABI, and SINU—featured cartoon animal logos and one depicting Elon Musk beneath an "Elon 2028 President" banner. Elliptic reported that the attackers paired each token with NEAR in decentralized liquidity pools. One group of wallets purchased the memecoins using stolen NEAR, while separate wallets sold them back to withdraw NEAR, severing direct wallet-to-wallet connections and disguising the movement as ordinary trading proceeds.[7][4][2][3]
Trading records show the tokens served no legitimate purpose and saw virtually no outside trading. In five cases, the wallet funding a new token sold the prior token 2 to 13 minutes earlier to finance the next launch. None traded after Nov. 8, when creators pulled the remaining pool funds. The Binance heist, which saw between $6.3 billion and $6.4 billion stolen on Oct. 29, was attributed by the FBI to North Korea's TraderTraitor hacking group. Elliptic noted the group previously used the same tactic to wash at least $24 million after the 2025 Bybit hack, and warned that while the technique slows down investigators, transactions remain traceable onchain.[7][6][4][5]
Key facts
- Hackers linked to North Korea created at least six disposable memecoins on the NEAR blockchain between Nov. 5 and Nov. 7 to launder funds from the Binance hack.
- The attackers spent roughly $90 per launch and routed 117,000 NEAR, worth about $430,000, through decentralized exchange liquidity pools.
- The six tokens were named FUK, OLCCL, MEILI, MMLI, DABI, and SINU, featuring artwork of animals and an "Elon 2028 President" banner.
- Launderers used separate wallets to buy and sell the tokens via liquidity pools to simulate normal trading and avoid direct transfers between wallets.
- The FBI attributed the underlying $6.3 billion to $6.4 billion Binance breach to North Korea's TraderTraitor hacking group, whose wallet retained about 11.8 million unmoved NEAR worth $43.7 million.
- Elliptic previously tracked the same memecoin laundering strategy being used to move at least $24 million after the 2025 Bybit hack.
Sources · 7 sources
- CN
crypto.news@cryptodotnewsPost on X ·
BREAKING: North Korea-linked hackers turn to NEAR memecoins to move funds from $6.4B Binance hack Elliptic reports that the attackers created at least six tokens between November 5 and 7, spending around $90 per launch before routing 117,000 NEAR worth approximately $430,000 through DEX liquidity pools to make the funds harder to trace.
Open source - SO
SolanaFloor@SolanaFloorPost on X ·
🚨INSIGHT: North Korean hackers are laundering funds stolen in the $6.4B @Binance hack through disposable memecoins, including an "Elon 2028 President" token, according to Elliptic. They create worthless tokens, pair them with real assets in DEX liquidity pools, then use separate wallets to buy and sell the tokens, making stolen funds appear as proceeds from ordinary trades. On @Solana, the hackers swapped stolen SOL into existing wrapped and thinly traded tokens before selling them for USDC and moving funds across chains. On NEAR, six newly created memecoins were used to move around 117,000 NEAR ($430K).
Open source - LS
Laura Shin@laurashinPost on X ·
Elliptic traced six self-made NEAR tokens, with logos from a monkey in a pink bow to an “Elon 2028 President” banner, used to move Binance hack funds. About 11.8 million stolen NEAR, worth $43.7 million, has not moved yet. https://t.co/O5A0htUoHW
Open source - TB
The Block@TheBlockCoPost on X ·
THE BLOCK: North Korea's launderers are creating throwaway memecoins, including one featuring Elon Musk under an "Elon 2028 President" banner, to move funds stolen in Binance's $6.4 billion hack, Elliptic said. So far, about $430,000 in stolen near:native has passed through six newly created tokens, using liquidity pools to make transfers look like normal trades. Elliptic previously tracked the same tactic moving at least $24 million after the 2025 Bybit hack.
Open source - TB
The BlockArticle ·
Binance hack launderers mint homemade Elon Musk, animal memecoins to move stolen funds: Elliptic Elliptic says the extra swaps slow investigators down, but the stolen funds remain traceable onchain.
Open source - PR
ProtosArticle ·
North Korea launders Binance funds with Elon Musk memecoin, report North Korea-linked hackers who stole $6.4 billion from the world’s biggest crypto exchange Binance are reportedly laundering the stolen funds using TRON, Solana, and NEAR-based memecoins. Crypto security analysts at Elliptic claim to have linked around $430,000 worth of NEAR to the creation of six memecoins themed around various animals, including ducks and chimpanzees. One of these tokens promotes Elon Musk as the future 2028 president. Elliptic mapped the North Korea-linked memecoin laundering process. Read more: How the Binance hack happened on-chain on Ethereum Once sold, the profit generated by the tokens is roughly equivalent to the amount of money that went in. Elliptic believes that the tokens were used for money laundering. This is based on the fact that nobody else was trading them, that they were paid for with the proceeds from a previous linked token launch, and that they were only traded for a short amount of time before never being used again. It also claims the memecoins attract little attention, are cheap to produce at only $90 per launch, and can slow down investigators’ tracing efforts by introducing more steps to the stolen funds’ journey. Laundering group has over $43M worth of NEAR tokens Funding for the memecoins came from hacking group TraderTraitor’s crypto wallet, which contained around $43.7 million worth of NEAR. Stolen funds were also traced to one token created on the TRON blockchain, and another on Solana. Elliptic didn’t say what tool was used to create the tokens, nor did it name the decentralised exchange where the funds were sent. It only notes that these entities “did nothing wrong; the launderers simply used them as any other user could.” Read more: Binance faces second probe over Iran-linked billions It’s not TraderTraitor’s first memecoin rodeo Elliptic spotted TraderTraitor carrying out this same memecoin laundering method in the aftermath of last year’s $1.5 billion Bybit hack. In this case, it used TRON-based memecoins and reportedly moved at least $24 million. Got a tip? Send us an email securely via Protos Leaks . For more informed news and investigations, follow us on X , Bluesky , and Google News , or subscribe to our YouTube channel. The post North Korea launders Binance funds with Elon Musk memecoin, report appeared first on Protos .
Open source - UN
UnchainedArticle ·
North Korea Turns DIY Meme Coins Into a Laundering Pipe for Stolen Binance Crypto, Elliptic Says Crypto launderers working for North Korea are spinning up disposable meme coins of their own to shuttle funds taken from Binance , blockchain analytics firm Elliptic said in a report published Monday. Over three days, Nov. 5 to Nov. 7, roughly 117,000 NEAR , about $430,000 , was routed through six of the tokens. The launderers paired each token with NEAR, the native coin of the NEAR Protocol blockchain, in its own liquidity pool , a pot of two assets on a decentralized exchange that anyone can swap against. One group of wallets paid stolen NEAR into the pool for the new token, and a second group sold the token back and pulled NEAR out. Because the pool sits in the middle, no transfer connects the two groups directly. “They exist only to put a pool between the stolen funds and the next wallet,” Elliptic wrote on X . Days before the tokens appeared, Jonty , founder of Pangolin Intelligence, said on Unchained that the networks laundering for North Korea shuffle funds between wallets “to essentially evade the eyes of transaction monitoring software,” naming Chainalysis, TRM Labs and Elliptic as examples. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . Six Tokens, One Chain of Wallets The NEAR tokens, FUK, OLCCL, MEILI, MMLI, DABI and SINU, carried cartoonish meme-coin artwork: one showed a monkey sporting a pink bow, another a duck posed against an American flag, and a third put Elon Musk beneath an “Elon 2028 President” banner. Elliptic said there is no suggestion Musk has any link to them. Each cost about 25 NEAR, or around $90, to launch. Elliptic said the trading data shows the tokens served no purpose beyond laundering. Outside traders were almost entirely absent. The laundering wallets themselves placed every sell order in all six tokens and every purchase in five of them; the lone exception was a sprinkling of FUK buys on launch day, a sliver of its trading. The tokens were also linked in a chain: in five cases, the wallet that bankrolled a new token’s creator had been dumping the prior token just 2 to 13 minutes before launch, so profits from one financed the next. None has traded since Nov. 8. That afternoon, four of the tokens’ creators pulled the funds still sitting in their pools. A Tactic First Seen With Bybit The trick isn’t new. Elliptic says it first saw it after Bybit lost $1.5 billion in 2025, when launderers used a worthless Tron token to move at least $24 million. In the Binance case, a similar Tron token turned up on Nov. 2, and a day later stolen SOL, Solana’s native token, went through existing thinly traded Solana tokens. The NEAR sums are small next to about $6.3 billion taken from Binance on Oct. 29, a theft the FBI attributed to North Korea’s TraderTraitor hacking group. About 11.8 million NEAR , worth $43.7 million, from the hack has not moved yet, according to Elliptic, which said the tokens are cheap to run and could carry far larger amounts. Every step stays visible onchain. “The technique slows investigators down rather than hiding the funds,” Elliptic’s Tom Robinson wrote in the report . The firm told compliance teams not to treat funds coming out of a liquidity pool as clean by default, listing warning signs such as tokens only days old, pools with a handful of traders, and wallets that only buy or only sell. Related Listen: How North Korea’s Launderers Try to Shake Off Blockchain Analytics The post North Korea Turns DIY Meme Coins Into a Laundering Pipe for Stolen Binance Crypto, Elliptic Says appeared first on Unchained .
Open source