coindesk.com
North Korean hackers are creating their own memecoins to launder funds stolen in the $6.3 billion Binance hack, using fake trading activity to make the proceeds look like legitimate profit.
The hackers moved about 117,000 $NEAR tokens, worth roughly $430,000, through six memecoins created between Nov. 5 and Nov. 7, according to an analysis from blockchain analytics firm Elliptic.
One of these tokens featured an image of Elon Musk under an “Elon 2028 President” banner, though Elliptic said there is no suggestion Musk is connected to the tokens. Their names followed memecoin habits, including a crude joke and the “inu” used in dog-themed memecoins.
The hackers paired each memecoin with $NEAR in its own liquidity pool on a decentralized exchange, then used one set of wallets to buy memecoins with stolen $NEAR and another to sell those same memecoins for $NEAR, so the funds never passed directly from one wallet to the other. That makes the money appear to be a result of profitable trading, rather than the hack.
“The launderers made six of these crypto tokens, and traded them only with themselves. That makes the stolen funds look like trading proceeds,” Elliptic co-founder and chief scientist Tom Robinson told CoinDesk.
Elliptic found that almost all trading came from wallets tied to the laundering scheme, with outside buyers accounting for less than 1% of one token's volume. Trading across all six tokens stopped by Nov. 8.
The FBI has pointed to North Korea's TraderTraitor group as responsible for the Oct. 29 Binance theft. The hackers have also used THORChain to convert stolen assets into bitcoin, which cannot be frozen by a central issuer.
Elliptic identified a similar memecoin laundering method after the 2025 Bybit hack, and said the new trades complicate efforts to trace the stolen funds but do not erase their trail.
