North Korean hackers linked to the record-breaking $6.3 billion Binance cryptocurrency theft are creating their own memecoins to disguise stolen funds as legitimate trading profits, according to a new investigation by blockchain analytics firm Elliptic. Researchers discovered that hackers associated with North Korea’s TraderTraitor operation created at least six fraudulent memecoins on the NEAR blockchain between November 5 and November 7, using decentralized exchange liquidity pools to move approximately 117,000 NEAR tokens worth $430,000 between controlled wallets. One token featured Elon Musk beneath an “Elon 2028 President” banner, while others used cartoon animals and familiar memecoin branding to blend into the speculative cryptocurrency market. Each token reportedly cost just 25 NEAR, approximately $90, to create, allowing the hackers to repeatedly generate disposable digital assets and obscure transaction trails. The findings reveal a sophisticated money laundering strategy following the October 29 Binance hack, which the Federal Bureau of Investigation (FBI) attributed to North Korean state-sponsored cybercriminals.
Elliptic Uncovers New Money Laundering Strategy Following Binance Hack
Blockchain intelligence company Elliptic published its findings on November 9, revealing how North Korean hackers are exploiting the ease of creating cryptocurrency tokens to disguise stolen funds.
The investigation was led by Dr. Tom Robinson, Elliptic’s co-founder and chief scientist, who identified a series of transactions involving newly created memecoins and wallets connected to the Binance theft.
Rather than transferring stolen cryptocurrency directly between wallets, the attackers used decentralized exchanges to make their transactions resemble ordinary speculative trading.
The strategy involved creating tokens with little or no legitimate market demand, establishing trading pools and moving stolen cryptocurrency through those pools using wallets under their control.
Researchers identified several characteristics that distinguished the activity from legitimate trading:
Six newly created memecoins were used to transfer approximately $430,000 in stolen NEAR.
The tokens were created between November 5 and November 7.
Almost all transactions involved wallets controlled by the suspected laundering network.
The tokens were traded intensively shortly after launch and then abandoned.
Funds leaving the trading pools were transferred into other assets or routed toward cross-chain bridges.
Elliptic concluded that the trading activity was designed to create misleading transaction histories rather than attract genuine cryptocurrency investors.
The investigation demonstrates how decentralized trading infrastructure can be exploited without requiring attackers to compromise the exchanges themselves.
Hackers Launch Six Memecoins on NEAR Blockchain
The laundering operation involved six tokens created on the NEAR Protocol, a blockchain network that supports decentralized applications and cryptocurrency transactions.
Each token was designed to resemble the thousands of speculative memecoins regularly launched across cryptocurrency markets.
The six tokens identified by Elliptic were:
| Memecoin | Creation date |
|---|---|
| FUK | November 5 |
| OLCCL | November 6 |
| MEILI | November 6 |
| MMLI | November 6 |
| DABI | November 6 |
| SINU | November 7 |
The tokens featured branding associated with internet memes, including cartoon animals, humorous imagery and references to popular cryptocurrency trends.
One token displayed Elon Musk beneath a fictional presidential campaign banner reading “Elon 2028 President.”
Elliptic emphasized that there is no evidence connecting Musk to the token or the laundering operation.
The use of recognizable imagery was intended to make the assets appear similar to ordinary speculative memecoins.
This approach is particularly effective in an environment where thousands of new tokens are launched regularly, often with little underlying utility or established trading history.
The hackers reportedly spent approximately 25 NEAR per token, equivalent to around $90 at the time.
Because the tokens were inexpensive to create, the attackers could abandon them after completing their transactions and launch replacements with minimal financial cost.
How Hackers Used Liquidity Pools to Disguise Stolen Cryptocurrency
The central feature of the operation was the manipulation of decentralized exchange liquidity pools.
A liquidity pool is a collection of cryptocurrency assets deposited into a smart contract that allows traders to exchange one token for another.
These pools are commonly used by decentralized exchanges to facilitate transactions without relying on traditional order books.
In this case, the hackers used the pools to create an indirect route between wallets holding stolen cryptocurrency and wallets receiving the proceeds.
The laundering process followed four main stages:
Create a new memecoin: The hackers generated a cryptocurrency token with no meaningful underlying utility or independent market demand.
Establish a liquidity pool: They paired the new token with NEAR on a decentralized exchange.
Purchase the memecoin using stolen funds: One group of wallets exchanged stolen NEAR for the newly created token.
Sell the memecoin through separate wallets: Another group of attacker-controlled wallets sold the tokens into the pool, receiving NEAR that appeared to originate from trading activity.
The result was a series of transactions that could resemble ordinary cryptocurrency trading when examined individually.
However, the wallets involved were controlled by the same laundering network.
This allowed the attackers to move value between addresses without making a direct wallet-to-wallet transfer.
The method did not remove the transactions from the blockchain.
Instead, it introduced additional layers of activity that investigators would need to analyze to determine where the funds originated.
$430,000 in Stolen NEAR Moved Through Fake Trading Activity
Elliptic identified approximately 117,000 NEAR tokens, valued at around $430,000, moving through the six fraudulent memecoins.
The researchers traced the funds from wallets associated with the Binance hack through intermediate addresses and into the newly created liquidity pools.
After the tokens were traded, nearly the same amount of NEAR emerged in separate receiving wallets.
Much of the cryptocurrency was subsequently converted into stablecoins or transferred toward cross-chain infrastructure.
The investigation also revealed that the operation was highly coordinated.
For five of the six memecoins, the wallets responsible for creating new tokens received funding from addresses that had already participated in earlier token sales.
In some cases, the funding arrived just two to thirteen minutes before the next token was launched.
This pattern suggests that the hackers were repeatedly recycling funds through newly created tokens.
Elliptic also found that the tokens were abandoned shortly after being used.
By November 8, trading activity across all six memecoins had stopped.
The creators of four tokens subsequently withdrew remaining liquidity from their pools.
These findings indicate that the tokens were created primarily to move stolen funds rather than support ongoing cryptocurrency communities or legitimate markets.
Almost All Memecoin Trading Came From Hacker-Controlled Wallets
One of the strongest indicators of money laundering was the absence of meaningful trading activity from independent investors.
According to Elliptic, wallets associated with the suspected laundering network accounted for virtually all trading across the six tokens.
The researchers identified several unusual patterns:
Five tokens had no identified outside buyers.
The FUK token attracted limited outside activity representing less than 1% of its trading volume.
DABI, MMLI and SINU each relied on a single buying wallet and a single selling wallet.
Trading activity was concentrated shortly after each token launched.
The amounts entering and leaving the liquidity pools closely matched.
These characteristics differ significantly from the activity typically associated with memecoins that attract speculative communities.
Legitimate memecoins may experience concentrated ownership or low trading activity, but the transaction patterns identified by Elliptic were directly connected to wallets funded with stolen cryptocurrency.
The investigation therefore relied on more than unusual trading volume or suspicious token names.
Researchers examined the relationships between wallet addresses, funding sources, token creation activity and the movement of funds through decentralized exchanges.
The evidence supported Elliptic’s conclusion that the tokens were being used as laundering instruments.
FBI Links $6.3 Billion Binance Hack to North Korea’s TraderTraitor Group
The memecoin laundering operation follows the October 29, 2026 Binance hack, one of the largest reported cryptocurrency thefts in history.
The attack resulted in approximately $6.3 billion in stolen digital assets, according to the figures reported by CoinDesk.
The FBI subsequently attributed the theft to TraderTraitor, a North Korean state-sponsored cybercrime operation associated with attacks targeting cryptocurrency businesses.
TraderTraitor has been linked to sophisticated social engineering campaigns, including attempts to compromise employees through fraudulent professional contacts and malicious software.
North Korean cybercriminal operations have increasingly targeted cryptocurrency companies because stolen digital assets can be transferred across borders without relying entirely on traditional banking infrastructure.
Following the Binance theft, blockchain investigators began tracking the stolen assets across multiple networks.
The hackers reportedly divided funds among numerous wallets and used different methods to convert and transfer the assets.
The memecoin operation represents one component of that broader laundering activity.
Although the $430,000 identified in the six NEAR tokens is substantial, it represents only a small portion of the total cryptocurrency stolen.
Elliptic reported that approximately 11.8 million NEAR, worth about $43.7 million, remained unmoved from the theft at the time of its investigation.
The larger challenge for investigators involves tracking billions of dollars across different assets, exchanges and blockchain networks.
Hackers Also Exploit Tron, Solana and THORChain
The investigation revealed that the attackers were not relying exclusively on the NEAR blockchain.
Elliptic identified similar laundering activity involving Tron and a related method involving Solana.
On November 2, investigators detected a newly created token on Tron that appeared to serve the same purpose as the later NEAR memecoins.
The following day, stolen SOL was routed through wrapped and thinly traded tokens on Solana before being exchanged for USDC and transferred toward other blockchain networks.
Unlike the NEAR operation, the Solana transactions involved existing tokens rather than exclusively newly created assets.
However, the underlying objective was similar: introducing additional trading activity between the stolen cryptocurrency and its eventual destination.
Investigators also identified the use of THORChain, a decentralized cross-chain liquidity protocol, to convert stolen assets into Bitcoin.
Bitcoin presents additional challenges for certain recovery efforts because it does not have a centralized token issuer capable of freezing balances in the same manner as some stablecoin issuers.
The attackers’ use of multiple networks demonstrates how sophisticated laundering operations can combine different blockchain tools.
Rather than depending on a single transaction method, the hackers appear to be introducing multiple layers of conversions and transfers to complicate investigations.
Similar Strategy Used After $1.5 Billion Bybit Hack
Elliptic’s investigation also identified similarities between the Binance laundering operation and activity following the February 2025 Bybit hack.
That incident resulted in approximately $1.5 billion in stolen cryptocurrency and was attributed to North Korean hackers.
Following the Bybit attack, investigators identified a laundering method involving newly created tokens on the Tron blockchain.
The attackers established liquidity pools containing worthless tokens and used those pools to move stolen cryptocurrency between controlled wallets.
According to Elliptic, at least $24 million was transferred through this method following the Bybit incident.
The similarities are significant because they suggest that the technique is not an isolated experiment.
Instead, it appears to be part of a recurring set of tactics used to disguise the movement of stolen cryptocurrency.
The Binance operation also demonstrates how the method can be adapted to different blockchain networks.
The ability to create inexpensive tokens and trade them through decentralized liquidity pools provides attackers with a repeatable approach that can be deployed quickly.
However, the technique remains traceable because blockchain transactions are publicly recorded.
Blockchain Transparency Still Allows Investigators to Follow the Money
Despite the additional complexity created by the fake memecoins, Elliptic emphasized that the laundering technique does not make stolen cryptocurrency completely untraceable.
Every token creation, liquidity pool transaction and wallet transfer remains recorded on the relevant blockchain.
Investigators can analyze those records to identify relationships between wallets and determine how funds move through different assets.
The primary challenge is the additional time and resources required to reconstruct the transaction history.
For example, a receiving wallet may appear to have earned cryptocurrency by selling a memecoin.
However, deeper analysis could reveal that the memecoin was created by a connected wallet and purchased using stolen assets.
This distinction is important for cryptocurrency exchanges and financial institutions responsible for screening suspicious transactions.
Elliptic identified several warning signs that compliance teams should monitor:
Newly created tokens with little or no established trading history.
Liquidity pools dominated by a small number of wallets.
Wallets that exclusively buy tokens while others exclusively sell.
Trading activity funded by addresses associated with known cryptocurrency thefts.
Tokens that experience intense trading immediately after launch and then become inactive.
Cryptocurrency deposits originating from suspicious liquidity pools.
The company warned that funds received from decentralized exchanges should not automatically be considered legitimate simply because they passed through a liquidity pool.
Effective blockchain monitoring requires tracing the origin of assets beyond the most recent transaction.
Fake Memecoins Create New Challenges for Crypto Exchanges and Regulators
The findings highlight a growing challenge for cryptocurrency exchanges, blockchain analytics companies and financial regulators.
Memecoins are relatively easy to create, and decentralized trading platforms generally allow users to launch and exchange tokens without obtaining approval from a centralized authority.
These features support open participation in cryptocurrency markets.
However, they can also be exploited by criminals attempting to disguise illicit transactions.
The Binance laundering operation demonstrates how attackers can use legitimate blockchain infrastructure for unlawful purposes without necessarily compromising the underlying technology.
Elliptic specifically indicated that the token creation tools, wallet applications and decentralized exchanges involved in the activity were not themselves accused of wrongdoing.
Instead, the attackers used publicly available functionality in a coordinated manner.
For cryptocurrency businesses, the incident reinforces the importance of monitoring transaction patterns rather than relying exclusively on lists of suspicious wallet addresses.
A wallet receiving cryptocurrency from a decentralized liquidity pool may have no obvious direct transaction with a known hacker address.
However, the funds could still be connected to stolen assets through earlier swaps.
This creates challenges for anti-money laundering compliance programs that depend on identifying the original source of cryptocurrency deposits.
As criminals develop new laundering methods, blockchain analytics providers will need to improve their ability to identify relationships between token launches, liquidity pools and suspicious wallet networks.
North Korea’s Memecoin Laundering Scheme Exposes New Crypto Security Threat
The discovery that North Korean hackers are creating disposable memecoins to launder proceeds from the $6.3 billion Binance hack reveals another method being used to exploit decentralized cryptocurrency markets.
According to Elliptic, the attackers created at least six tokens on NEAR, moved approximately $430,000 in stolen cryptocurrency through their liquidity pools and abandoned the tokens once the transfers were completed.
The operation required relatively little capital, with each token costing approximately $90 to create.
Researchers also identified related techniques involving Tron and Solana, demonstrating that the approach can be adapted across multiple blockchain networks.
The strategy builds on laundering activity previously observed after the 2025 Bybit hack, suggesting that North Korean cybercriminals are refining methods that can be repeated across major cryptocurrency thefts.
However, the transactions remain visible on public blockchains, allowing investigators to reconstruct the movement of funds despite the additional layers.
For cryptocurrency exchanges and compliance teams, the incident underscores the importance of analyzing transaction histories beyond their immediate sources.
For the broader industry, it demonstrates how criminals can exploit the same permissionless infrastructure that enables decentralized trading and rapid token creation.
North Korea’s use of fake memecoins to disguise stolen Binance funds highlights an evolving challenge for blockchain security: criminals are no longer simply transferring stolen cryptocurrency between wallets but are manufacturing entire trading markets to make illicit transactions appear legitimate. While blockchain transparency still allows investigators to follow the money, the speed and low cost of these techniques could make future cryptocurrency theft investigations increasingly complex.
