BTC $72,814 
EQQQQ $655.75 Last updated 8 Nov 2026, 12:03 UTC
ETH $2,019 
MGLOEURO $111,813 
USDT $0.9990 
BNB $659.65 
USDC $0.9995 
XRP $1.04 
SOL $82.15 
TRX $0.3160 Hacks & Security · Explained
North Korea-linked hackers used fake meme coins to launder Binance funds, Elliptic says
Blockchain analytics firm Elliptic says launderers created tokens and liquidity pools to obscure proceeds from the record Binance hack.
Key takeaways
- Token swaps. Elliptic found North Korea-linked wallets using newly minted tokens and DEX pools to break direct links between incoming and outgoing funds.
- Small but repeatable. Six NEAR tokens cost about $90 each to create and moved roughly $430,000, while most stolen NEAR identified by Elliptic remains unmoved.
- Human entry point. Binance traced the initial compromise to a malicious coding assignment downloaded during a fake job interview.
What happened
Elliptic says North Korea-linked attackers are minting new meme-style tokens and placing them in decentralized exchange liquidity pools to move funds stolen in the Binance hack. The firm observed the pattern on Tron and NEAR and a related version on Solana. The pool separates the wallets that put funds in from those that take funds out, making direct links harder to spot.
On NEAR, wallets created six tokens between Nov. 5 and Nov. 7: FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each was paired with NEAR in its own pool, and creation cost about 25 NEAR, or $90. Elliptic said the six tokens moved around 117,000 NEAR, worth about $430,000, with buyers funded from stolen NEAR and separate sellers receiving the paired asset. Much of the value later became stablecoins or crossed a bridge. The tokens traded heavily soon after launch and were inactive after Nov. 8, and Elliptic said proceeds from earlier launches helped fund later ones.
Elliptic saw a Tron token created on Nov. 2 that appeared made for laundering, and Solana swapped into wrapped or thinly traded tokens on Nov. 3 before becoming USDC. The firm first identified the design while tracing the 2025 Bybit theft, where a worthless Tron token moved at least $24 million. Binance's preliminary investigation linked the hack's entry to a September fake job interview; Cointelegraph and Blockonomi report a $6.3 billion loss, while CryptoPotato's headline says $6.4 billion.
Why it matters
The method leaves a blockchain trail, but it adds swaps and wallets that slow investigators. Elliptic warned exchanges not to treat funds arriving from liquidity pools as automatically legitimate. Fresh tokens, pools with very few participants and addresses funded shortly before trading can signal laundering. Since creating a token costs little, the process can be repeated.
The scale is still partial. The six NEAR tokens moved only a small share of the haul; Elliptic estimated about 11.8 million NEAR, worth roughly $43.7 million, had not moved. Binance said it blocked 57 suspected North Korea-linked threats this year, about one every five days, and tightened device controls, access controls and endpoint protection, rebuilt affected wallet systems and internal AI tools, and increased spending on developer-environment security after the attack.
What the data shows
Reported figures: six tokens (FUK, OLCCL, MEILI, MMLI, DABI and SINU) created Nov. 5 to 7; about 25 NEAR, or $90, to create each; about 117,000 NEAR, or $430,000, moved; about 11.8 million NEAR, or $43.7 million, unmoved; at least $24 million moved in the Bybit case; 57 suspected North Korea-linked threats blocked by Binance this year.
Background
Binance's chief security officer, Jimmy Su, had warned about fake job interviews in a July interview with Cointelegraph. He said fraudulent recruiting was a major internal concern and explained how a coding test could compromise an employee's device and expose credentials. Those remarks were not in Cointelegraph's July coverage but gained relevance after the hack. Binance later said the malicious assignment evaded endpoint defenses through obfuscation and other techniques.
In September, a software engineer downloaded a malicious coding assignment onto a work computer during a fake interview, part of a multistage attack that ended with October's theft. Su said employees may explore outside roles, but company devices were the risk, and Binance had to detect and stop malicious code. Its red team had run monthly phishing simulations for three to four years. A recruiter told Cointelegraph that some clients now ask whether candidates were met in person.
What is still unclear
Reports differ on the total Binance loss, citing $6.3 billion or $6.4 billion. The reports do not say how much of the full haul has gone through meme tokens, and attribution to North Korea-linked actors comes from Elliptic's tracking and Binance's statements. Binance said some technical details would remain confidential, and an independent review is underway.
What to watch
Exchanges and compliance teams should watch for newly created tokens, pools with few wallets and accounts funded just before trades. Further movement from the unmoved NEAR stash and Binance's independent security review are also worth monitoring.
Questions readers ask
What is the meme-coin laundering method?
Attackers create a new token, pair it with an asset such as NEAR or a stablecoin in a DEX pool, buy the token with stolen funds from one set of wallets, and sell it from another set. The pool sits between the transactions, making the fund flow harder to follow quickly.
Did this move all the Binance hack funds?
No. Elliptic's NEAR example covers about $430,000, and the firm estimated roughly $43.7 million in NEAR had not moved. The reports do not specify the total amount moved through meme tokens.
How did attackers get into Binance?
Binance's preliminary investigation says a software engineer downloaded a malicious coding assignment onto a work computer during a fake job interview in September. That compromise was part of a multistage attack that led to October's theft.
