North Korean hackers linked to the record-breaking $6.3 billion Binance cryptocy theft are creating their own memecoins to disguise stolen funds as legitimate trading profits, according to a new investigation by blockchain analytics firm Elliptic. Researchers discovered that hackers associated with North Korea’s TraderTraitor operation created at least six fraudulent memecoins on the NEAR blockchain between November 5 and November 7, using decentralized exchange liquidity pools to move approximately 117,000 NEAR tokens worth $430,000 between controlled wallets. One token featured Elon Musk beneath an “Elon 2028 President” banner, while others used cartoon animals and familiar memecoin branding to blend into the speculative cryptocy market. Each token reportedly cost just 25 NEAR, approximately $90, to create, allowing the hackers to repeatedly generate disposable digital assets and obscure transaction trails. The findings reveal a sophisticated money laundering strategy following the October 29 Binance hack, which the Federal Bureau of Investigation (FBI) attributed to North Korean state-sponsored cybercriminals.
Blockchain intelligence company Elliptic published its findings on November 9, revealing how North Korean hackers are exploiting the ease of creating cryptocy tokens to disguise stolen funds.
The investigation was led by Dr. Tom Robinson, Elliptic’s co-founder and chief scientist, who identified a series of transactions involving newly created memecoins and wallets connected to the Binance theft.
Rather than transferring stolen cryptocy directly between wallets, the attackers used decentralized exchanges to make their transactions resemble ordinary speculative trading.
The strategy involved creating tokens with little or no legitimate market demand, establishing trading pools and moving stolen cryptocy through those pools using wallets under their control.
Researchers identified several characteristics that distinguished the activity from legitimate trading:
Six newly created memecoins were used to transfer approximately $430,000 in stolen NEAR.
The tokens were created between November 5 and November 7.
Almost all transactions involved wallets controlled by the suspected laundering network.
The tokens were traded intensively shortly after launch and then abandoned.
Funds leaving the trading pools were transferred into other assets or routed toward cross-chain bridges.
Elliptic concluded that the trading activity was designed to create misleading transaction histories rather than attract genuine cryptocy investors.
The investigation demonstrates how decentralized trading infrastructure can be exploited without requiring attackers to compromise the exchanges themselves.
The laundering operation involved six tokens created on the NEAR Protocol, a blockchain network that supports decentralized applications and cryptocy transactions.
Each token was designed to resemble the thousands of speculative memecoins regularly launched across cryptocy markets.
The six tokens identified by Elliptic were:
| Memecoin | Creation date |
|---|---|
| FUK | November 5 |
| OLCCL | November 6 |
| MEILI | November 6 |
| MMLI | November 6 |
| DABI | November 6 |
| SINU | November 7 |
The tokens featured branding associated with internet memes, including cartoon animals, humorous imagery and references to popular cryptocy trends.
One token displayed Elon Musk beneath a fictional presidential campaign banner reading “Elon 2028 President.”
Elliptic emphasized that there is no evidence connecting Musk to the token or the laundering operation.
The use of recognizable imagery was intended to make the assets appear similar to ordinary speculative memecoins.
This approach is particularly effective in an environment where thousands of new tokens are launched regularly, often with little underlying utility or established trading history.
The hackers reportedly spent approximately 25 NEAR per token, equivalent to around $90 at the time.
Because the tokens were inexpensive to create, the attackers could abandon them after completing their transactions and launch replacements with minimal financial cost.
The central feature of the operation was the manipulation of decentralized exchange liquidity pools.
A liquidity pool is a collection of cryptocy assets deposited into a smart contract that allows traders to exchange one token for another.
These pools are commonly used by decentralized exchanges to facilitate transactions without relying on traditional order books.
In this case, the hackers used the pools to create an indirect route between wallets holding stolen cryptocy and wallets receiving the proceeds.
The laundering process followed four main stages:
Create a new memecoin: The hackers generated a cryptocy token with no meaningful underlying utility or independent market demand.
Establish a liquidity pool: They paired the new token with NEAR on a decentralized exchange.
Purchase the memecoin using stolen funds: One group of wallets exchanged stolen NEAR for the newly created token.
Sell the memecoin through separate wallets: Another group of attacker-controlled wallets sold the tokens into the pool, receiving NEAR that appeared to originate from trading activity.
The result was a series of transactions that could resemble ordinary cryptocy trading when examined individually.
However, the wallets involved were controlled by the same laundering network.
This allowed the attackers to move value between addresses without making a direct wallet-to-wallet transfer.
The method did not remove the transactions from the blockchain.
Instead, it introduced additional layers of activity that investigators would need to analyze to determine where the funds originated.
Elliptic identified approximately 117,000 NEAR tokens, valued at around $430,000, moving through the six fraudulent memecoins.
The researchers traced the funds from wallets associated with the Binance hack through intermediate addresses and into the newly created liquidity pools.
After the tokens were traded, nearly the same amount of NEAR emerged in separate receiving wallets.
Much of the cryptocy was subsequently converted into stablecoins or transferred toward cross-chain infrastructure.
The investigation also revealed that the operation was highly coordinated.
For five of the six memecoins, the wallets responsible for creating new tokens received funding from addresses that had already participated in earlier token sales.
In some cases, the funding arrived just two to thirteen minutes before the next token was launched.
This pattern suggests that the hackers were repeatedly recycling funds through newly created tokens.
Elliptic also found that the tokens were abandoned shortly after being used.
By November 8, trading activity across all six memecoins had stopped.
The creators of four tokens subsequently withdrew remaining liquidity from their pools.
These findings indicate that the tokens were created primarily to move stolen funds rather than support ongoing cryptocy communities or legitimate markets.
One of the strongest indicators of money laundering was the absence of meaningful trading activity from independent investors.
According to Elliptic, wallets associated with the suspected laundering network accounted for virtually all trading across the six tokens.
The researchers identified several unusual patterns:
Five tokens had no identified outside buyers.
The FUK token attracted limited outside activity representing less than 1% of its trading volume.
DABI, MMLI and SINU each relied on a single buying wallet and a single selling wallet.
Trading activity was concentrated shortly after each token launched.
The amounts entering and leaving the liquidity pools closely matched.
These characteristics differ significantly from the activity typically associated with memecoins that attract speculative communities.
Legitimate memecoins may experience concentrated ownership or low trading activity, but the transaction patterns identified by Elliptic were directly connected to wallets funded with stolen cryptocy.
The investigation therefore relied on more than unusual trading volume or suspicious token names.
Researchers examined the relationships between wallet addresses, funding sources, token creation activity and the movement of funds through decentralized exchanges.
The evidence supported Elliptic’s conclusion that the tokens were being used as laundering instruments.
The memecoin laundering operation follows the October 29, 2026 Binance hack, one of the largest reported cryptocy thefts in history.
The attack resulted in approximately $6.3 billion in stolen digital assets, according to the figures reported by CoinDesk.
The FBI subsequently attributed the theft to TraderTraitor, a North Korean state-sponsored cybercrime operation associated with attacks targeting cryptocy businesses.
TraderTraitor has been linked to sophisticated social engineering campaigns, including attempts to compromise employees through fraudulent professional contacts and malicious software.
North Korean cybercriminal operations have increasingly targeted cryptocy companies because stolen digital assets can be transferred across borders without relying entirely on traditional banking infrastructure.
Following the Binance theft, blockchain investigators began tracking the stolen assets across multiple networks.
The hackers reportedly divided funds among numerous wallets and used different methods to convert and transfer the assets.
The memecoin operation represents one component of that broader laundering activity.
Although the $430,000 identified in the six NEAR tokens is substantial, it represents only a small portion of the total cryptocy stolen.
Elliptic reported that approximately 11.8 million NEAR, worth about $43.7 million, remained unmoved from the theft at the time of its investigation.
The larger challenge for investigators involves tracking billions of dollars across different assets, exchanges and blockchain networks.
The investigation revealed that the attackers were not relying exclusively on the NEAR blockchain.
Elliptic identified similar laundering activity involving Tron and a related method involving Solana.
On November 2, investigators detected a newly created token on Tron that appeared to serve the same purpose as the later NEAR memecoins.
The following day, stolen SOL was routed through wrapped and thinly traded tokens on Solana before being exchanged for USDC and transferred toward other blockchain networks.
Unlike the NEAR operation, the Solana transactions involved existing tokens rather than exclusively newly created assets.
However, the underlying objective was similar: introducing additional trading activity between the stolen cryptocy and its eventual destination.
Investigators also identified the use of THORChain, a decentralized cross-chain liquidity protocol, to convert stolen assets into Bitcoin.
Bitcoin presents additional challenges for certain recovery efforts because it does not have a centralized token issuer capable of freezing balances in the same manner as some stablecoin issuers.
The attackers’ use of multiple networks demonstrates how sophisticated laundering operations can combine different blockchain tools.
Rather than depending on a single transaction method, the hackers appear to be introducing multiple layers of conversions and transfers to complicate investigations.
Elliptic’s investigation also identified similarities between the Binance laundering operation and activity following the February 2025 Bybit hack.
That incident resulted in approximately $1.5 billion in stolen cryptocy and was attributed to North Korean hackers.
Following the Bybit attack, investigators identified a laundering method involving newly created tokens on the Tron blockchain.
The attackers established liquidity pools containing worthless tokens and used those pools to move stolen cryptocy between controlled wallets.
According to Elliptic, at least $24 million was transferred through this method following the Bybit incident.
The similarities are significant because they suggest that the technique is not an isolated experiment.
Instead, it appears to be part of a recurring set of tactics used to disguise the movement of stolen cryptocy.
The Binance operation also demonstrates how the method can be adapted to different blockchain networks.
The ability to create inexpensive tokens and trade them through decentralized liquidity pools provides attackers with a repeatable approach that can be deployed quickly.
However, the technique remains traceable because blockchain transactions are publicly recorded.
Despite the additional complexity created by the fake memecoins, Elliptic emphasized that the laundering technique does not make stolen cryptocy completely untraceable.
Every token creation, liquidity pool transaction and wallet transfer remains recorded on the relevant blockchain.
Investigators can analyze those records to identify relationships between wallets and determine how funds move through different assets.
The primary challenge is the additional time and resources required to reconstruct the transaction history.
For example, a receiving wallet may appear to have earned cryptocy by selling a memecoin.
However, deeper analysis could reveal that the memecoin was created by a connected wallet and purchased using stolen assets.
This distinction is important for cryptocy exchanges and financial institutions responsible for screening suspicious transactions.
Elliptic identified several warning signs that compliance teams should monitor:
Newly created tokens with little or no established trading history.
Liquidity pools dominated by a small number of wallets.
Wallets that exclusively buy tokens while others exclusively sell.
Trading activity funded by addresses associated with known cryptocy thefts.
Tokens that experience intense trading immediately after launch and then become inactive.
Cryptocy deposits originating from suspicious liquidity pools.
The company warned that funds received from decentralized exchanges should not automatically be considered legitimate simply because they passed through a liquidity pool.
Effective blockchain monitoring requires tracing the origin of assets beyond the most recent transaction.
The findings highlight a growing challenge for cryptocy exchanges, blockchain analytics companies and financial regulators.
Memecoins are relatively easy to create, and decentralized trading platforms generally allow users to launch and exchange tokens without obtaining approval from a centralized authority.
These features support open participation in cryptocy markets.
However, they can also be exploited by criminals attempting to disguise illicit transactions.
The Binance laundering operation demonstrates how attackers can use legitimate blockchain infrastructure for unlawful purposes without necessarily compromising the underlying technology.
Elliptic specifically indicated that the token creation tools, wallet applications and decentralized exchanges involved in the activity were not themselves accused of wrongdoing.
Instead, the attackers used publicly available functionality in a coordinated manner.
For cryptocy businesses, the incident reinforces the importance of monitoring transaction patterns rather than relying exclusively on lists of suspicious wallet addresses.
A wallet receiving cryptocy from a decentralized liquidity pool may have no obvious direct transaction with a known hacker address.
However, the funds could still be connected to stolen assets through earlier swaps.
This creates challenges for anti-money laundering compliance programs that depend on identifying the original source of cryptocy deposits.
As criminals develop new laundering methods, blockchain analytics providers will need to improve their ability to identify relationships between token launches, liquidity pools and suspicious wallet networks.
The discovery that North Korean hackers are creating disposable memecoins to launder proceeds from the $6.3 billion Binance hack reveals another method being used to exploit decentralized cryptocy markets.
According to Elliptic, the attackers created at least six tokens on NEAR, moved approximately $430,000 in stolen cryptocy through their liquidity pools and abandoned the tokens once the transfers were completed.
The operation required relatively little capital, with each token costing approximately $90 to create.
Researchers also identified related techniques involving Tron and Solana, demonstrating that the approach can be adapted across multiple blockchain networks.
The strategy builds on laundering activity previously observed after the 2025 Bybit hack, suggesting that North Korean cybercriminals are refining methods that can be repeated across major cryptocy thefts.
However, the transactions remain visible on public blockchains, allowing investigators to reconstruct the movement of funds despite the additional layers.
For cryptocy exchanges and compliance teams, the incident underscores the importance of analyzing transaction histories beyond their immediate sources.
For the broader industry, it demonstrates how criminals can exploit the same permissionless infrastructure that enables decentralized trading and rapid token creation.
North Korea’s use of fake memecoins to disguise stolen Binance funds highlights an evolving challenge for blockchain security: criminals are no longer simply transferring stolen cryptocy between wallets but are manufacturing entire trading markets to make illicit transactions appear legitimate. While blockchain transparency still allows investigators to follow the money, the speed and low cost of these techniques could make future cryptocy theft investigations increasingly complex.
BNY (NYSE: BNY), one of the world's largest financial services and custody institutions, has partnered…
Bitcoin plunged below $72,000 on Thursday as institutional investors continued withdrawing money from U.S. spot…
Nvidia co-founder and CEO Jensen Huang has resigned after 33 years leading the artificial intelligence…
TRON, Tether and blockchain analytics company Chainalysis have launched the Digital Crime Task Force (DCTF),…
The U.S. Department of Justice (DOJ), major Wall Street banking organizations and leading decentralized finance…
Cryptocy exchange OKX and Intercontinental Exchange (ICE), the parent company of the New York Stock…