North Korea's Hackers Mint Throwaway Memecoins to Launder $430000 From Binance Heist

North Korean operatives behind the $6.3 billion Binance theft are minting their own memecoins and trading them back and forth to disguise stolen crypto as trading profit, according to blockchain analytics firm Elliptic.

Roughly 117,000 NEAR tokens, valued at $430,000, were pushed through six homemade tokens created between Nov. 5 and Nov. 7, the firm said in a report published Monday. The coins carried standard memecoin branding, including a monkey with a pink bow and an image of Elon Musk under an "Elon 2028 President" banner. Elliptic said there is no indication Musk had any connection to the tokens.

The FBI has attributed the Oct. 29 Binance breach to TraderTraitor, a hacking group tied to North Korea. The theft is the largest on record in crypto.

The mechanics are simple and cheap. The launderers create a token and pair it with a real asset such as NEAR in a liquidity pool on a decentralized exchange. One set of wallets buys the token using stolen funds; a separate set of wallets controlled by the same operation later sells it back into the same pool and withdraws the paired asset. Because the pool sits between the two sides, no direct transfer links the buying wallet to the selling wallet, and the second wallet looks like an ordinary trader who booked a gain.

"The launderers made six of these crypto tokens, and traded them only with themselves. That makes the stolen funds look like trading proceeds," Elliptic co-founder and chief scientist Tom Robinson told CoinDesk.

In the report, Robinson put it more bluntly: "The launderers' tokens are made to be used once and thrown away. Nobody outside the laundering operation buys them, and their price is whatever the launderers choose to set."

Elliptic's evidence points to tokens built purely for the job. Wallets in the laundering network accounted for every sale of all six coins and bought every unit of five of them; outside activity was limited to a handful of small FUK purchases on the token's first day. Five of the six creators were funded by a wallet that had been selling an earlier token minutes before the new one launched, so the proceeds of one coin paid for the . Each token did at least three-quarters of its trading within a single day, and none has traded since Sunday. Creation cost ran $90 apiece.

Note: The NEAR figure is a small slice of the total theft; Elliptic describes the memecoin route as one of many layered techniques rather than the main channel.

Similar activity surfaced on other chains. A purpose-built token appeared on Tron on Nov. 2, and on Solana the group took a different tack, swapping stolen SOL into existing, thinly traded tokens rather than minting new ones.

This is not a first. Elliptic traced the same playbook to laundering of proceeds from the $1.4 billion Bybit hack in February 2025, when at least $24 million moved through a worthless token on Tron. Memecoins were far more popular then, which helps explain how tens of millions of dollars could pass through the strategy.

The memecoin route is one thread in a much larger laundering effort. Elliptic says TraderTraitor has spread funds across more than 20,000 wallets on 16 blockchains and at least 36 services, including cross-chain bridges, lending vaults and the Privacy Cash privacy pool. 7,000 ether, worth roughly $15 million, entered Tornado Cash after Sunday, and around 12,200 ETH ($29 million), mostly from sales of stolen SOL, had passed through THORChain into bitcoin by Wednesday evening. Roughly 3,000 BTC ($225 million) converted from other stolen assets now sits in fresh bitcoin addresses, with 130 BTC ($10 million) routed through Wasabi-style CoinJoin transactions.

Not all of the haul was available to move. Tether, Circle and other issuers froze assets tied to the theft almost immediately, cutting the attackers off from roughly $3 billion. Tether froze the stolen USDT on Ethereum just 37 minutes after it landed in the attacker's wallet, according to Elliptic.

11.8 million NEAR ($43.7 million) of the stolen tokens has not moved, the firm added.

The technique slows investigators rather than blinding them, Elliptic said. "Every step of this technique is recorded publicly on the blockchain, and investigators can follow it. It does not hide the funds so much as slow down the people tracing them."

Because minting a token costs so little, the group can keep creating and discarding them at will. Elliptic's report warned crypto businesses not to treat funds arriving through liquidity pools as clean by default, and said launderers "layer many cheap techniques, each adding a little more delay."