North Korean Hackers Use Six Memecoins to Launder $430,000 From Binance Hack
North Korean hackers have created six memecoins to disguise cryptocurrency stolen in the $6.3 billion Binance hack, using artificial trading activity to make illicit funds appear as legitimate trading profits, according to blockchain analytics firm Elliptic.
The laundering operation involved approximately 117,000 NEAR tokens, valued at around $430,000, which were moved through six newly created memecoins between November 5 and November 7. Elliptic identified the transactions as part of an investigation into how the attackers attempted to conceal the origins of the stolen cryptocurrency.
Six Memecoins Used to Disguise Stolen NEAR Tokens
According to Elliptic, the hackers created six separate tokens and paired each one with NEAR in individual liquidity pools on a decentralized exchange. The tokens followed familiar memecoin naming conventions, including dog-themed references using the word "inu" and at least one crude joke.
One of the tokens also featured an image of Elon Musk beneath an "Elon 2028 President" banner. However, Elliptic explicitly stated that there is no suggestion Musk had any connection to the tokens or the laundering operation.
The scheme relied on transactions between wallets controlled by the attackers. One group of wallets purchased the newly created memecoins using stolen NEAR tokens, while another group subsequently sold those same tokens in exchange for NEAR.
By separating the buying and selling activity across different wallets, the hackers attempted to make the resulting NEAR balances look like proceeds from successful cryptocurrency trading rather than funds originating from the Binance theft.
"The launderers made six of these crypto tokens, and traded them only with themselves. That makes the stolen funds look like trading proceeds," Elliptic co-founder and chief scientist Tom Robinson told CoinDesk.
Almost All Trading Activity Came From Connected Wallets
Elliptic's analysis found that nearly all trading activity involving the six memecoins originated from wallets associated with the laundering scheme. External participants accounted for less than 1% of the trading volume in one of the tokens, highlighting how limited genuine market participation was.
Trading activity across all six memecoins had stopped by November 8. The coordinated transactions indicate that the tokens were primarily created as instruments for moving and disguising cryptocurrency rather than establishing independent trading markets.
FBI Links Binance Theft to North Korea's TraderTraitor Group
The FBI has identified North Korea's TraderTraitor group as responsible for the October 29 Binance theft. Beyond the memecoin transactions, the attackers have also used THORChain to convert stolen assets into Bitcoin.
The use of Bitcoin presents additional challenges for recovery efforts because it does not have a central issuer capable of freezing tokens at the network level. This differs from certain centrally issued digital assets that may support freezing mechanisms.
Elliptic also identified a comparable memecoin-based laundering technique following the 2025 Bybit hack, suggesting that the approach has appeared in more than one major cryptocurrency theft.
Although creating artificial trading activity can complicate blockchain investigations by making stolen funds resemble legitimate market proceeds, Elliptic said the technique does not eliminate the transaction trail. The movement of funds can still be traced through blockchain analysis.
source: coindesk
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.