Key takeaways
- North Korean hackers laundered $430K through six homemade memecoins
- Fake trading activity disguised stolen NEAR as legitimate proceeds
- Roughly $3 billion remains in wallets linked to Binance's theft
North Korean hackers are creating their own memecoins to launder cryptocurrency stolen in Binance's record $6.4 billion security breach, using artificial trading activity to disguise illicit transfers as ordinary market transactions.
According to a November 9 investigation by blockchain analytics firm Elliptic, attackers moved approximately 117,000 NEAR tokens, worth $430,000, through six newly created cryptocurrencies between November 5 and 7.
The discovery reveals another layer of the laundering operation following the October 29 attack, which investigators linked to North Korea's TraderTraitor group. Unlike the original Binance security breach, the latest activity involved manipulating decentralized trading infrastructure rather than accessing exchange wallets.
North Korean Hackers Create Six Worthless Memecoins
Elliptic identified six tokens named FUK, OLCCL, MEILI, MMLI, DABI and SINU, each created specifically to move stolen cryptocurrency through decentralized exchange liquidity pools.
The attackers reportedly spent approximately 25 NEAR, or $90, creating each token before pairing it with NEAR in a trading pool.
One group of attacker-controlled wallets purchased the memecoins using stolen assets. Separate wallets then sold those tokens through the same pools, receiving NEAR without a direct transfer from the original theft-linked addresses.
The receiving wallets consequently appeared to collect legitimate trading proceeds, although investigators could trace their connection to the stolen funds.
Elliptic found that almost every transaction involved wallets connected to the laundering operation. Three tokens had only one buying wallet and one selling wallet.
All six tokens stopped trading by November 8, suggesting they were disposable instruments rather than genuine cryptocurrency projects.
The findings add another dimension to the attackers' previously documented XRP transfers following the initial theft.
Binance Hack Laundering Expands Across 16 Blockchains
The $430,000 moved through memecoins represents only a fraction of the stolen assets.
Elliptic's broader investigation identified more than 20,000 wallets, 65,000 transactions and at least 36 services spanning 16 blockchain networks.
As of November 9, approximately $3 billion remained in addresses associated with the theft, primarily in Bitcoin and Ethereum. Another $2.85 billion had been frozen.
The operation has also involved decentralized exchanges, bridges and privacy tools as attackers attempted to move assets beyond their original wallets.
Earlier XRP theft investigations identified approximately $296 million in stolen XRP, while stablecoin freezes demonstrated how issuer-controlled restrictions could prevent some assets from moving.
Memecoin Laundering Repeats a Previous North Korean Strategy
The method closely resembles tactics identified after the 2025 Bybit hack, when North Korean-linked operators reportedly moved at least $24 million through a homemade token on Tron.
That earlier Bybit laundering investigation highlighted the challenges of tracking large cryptocurrency thefts across decentralized services.
