North Korea launders Binance hack funds through homemade meme coins, Elliptic says

What happened

North Korean operators laundering proceeds from the Binance theft have started minting their own meme tokens and routing stolen funds through the tokens' liquidity pools, according to blockchain analytics firm Elliptic, which published its findings on Monday. Between Nov. 5 and Nov. 7 the group created at least six tokens on the NEAR blockchain, named FUK, OLCCL, MEILI, MMLI, DABI and SINU, and paired each one with NEAR in its own trading pool.

The flow Elliptic described works in four steps. The launderers create a token with a public launch tool, open a pool pairing it with a real asset such as NEAR or a stablecoin, use stolen funds from one group of wallets to buy the new token, then sell it back into the same pool from a second group of wallets that collects the real asset. Because the pool sits between the two sides, the stolen funds never pass directly from a buying wallet to a collecting wallet, and the collectors look like ordinary traders who took a profit. Roughly 117,000 NEAR moved through the six tokens, valued at about $421,000 to $430,000 in the two reports.

Launching each token cost about 25 NEAR, or roughly $90. All six were traded heavily within hours of creation and then dropped: none has traded since Nov. 8, and the creators of four of them withdrew the remaining liquidity that afternoon. Five of the six creators received funding from a wallet that had sold the previous token between two and 13 minutes before the next launch, linking the tokens into a chain. The branding ranged from monkeys to an image of Elon Musk under an "Elon 2028 President" banner, and Elliptic said Musk has no connection to the coins.

Why it matters

The tokens do not conceal the funds, since every step remains visible on a public ledger. What they provide is delay. Each additional hop slows tracing while the launderers race to move assets before they are flagged, and at about $90 per token the pools are cheap enough to discard after use. Elliptic co-founder and chief scientist Tom Robinson noted that meme tokens are usually treated as joke coins whose prices swing on hype, and said North Korea's launderers have put them to a different purpose. The firm advised compliance teams to scrutinise funds arriving from liquidity pools, particularly pools built around newly created tokens.

What the data shows

Elliptic's wider update said roughly 3,000 BTC, about $225 million, has been converted from other stolen assets into new bitcoin addresses. About 11.8 million NEAR from the theft has not moved, worth around $43.7 million at the firm's estimate, or about $42.4 million at a NEAR price of $3.60 cited by U.Today. All of the stolen SOL has been swapped, bridged or mixed, and much of the XRP route has fed into bitcoin. Around $2.85 billion of the original haul has been frozen, and only a negligible amount appears to have been cashed out. Since the theft, Elliptic has tracked activity across more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions. Trading in the meme tokens was almost entirely internal: a few small purchases of FUK on its first day accounted for less than 1% of its volume, and most of the NEAR that came out of the pools went into stablecoins or a cross-chain bridge.

Background

Elliptic first documented the same method during the laundering of the February 2025 Bybit theft, which was also attributed to the TraderTraitor group, when a worthless token on Tron helped move at least $24 million. In the Binance case the firm spotted a comparable token on Tron on Nov. 2 and a variant on Solana on Nov. 3, where stolen SOL was swapped into existing thinly traded tokens and then sold for USDC. The Binance theft took place on Oct. 29 and the exchange has put the loss at $6.34 billion; the FBI attributed it to TraderTraitor. Binance said the attack began with a fake job interview and ran for five months before any coins moved, and blockchain firms linked the breach to the group within a day. The exchange has reopened withdrawals in stages and said it covered customer losses from its own funds. Elliptic put North Korea's 2025 haul above $2 billion and its cumulative known total above $6 billion before the Binance incident.

What to watch

Only a small portion of the stolen funds has passed through meme tokens so far, so the technique's weight in the overall laundering effort remains limited. The question investigators face is whether homemade liquidity pools can keep appearing faster than blocklists and analytics tools adapt to them.

Questions readers ask