Six Tokens and Two Wallet Clusters
Elliptic’s Nov. 9 report says launderers tied to North Korea created six throwaway tokens to disguise about $430,000 linked to the $6.4 billion Binance hack. The tokens were FUK, OLCCL, MEILI, MMLI, DABI and SINU. They were minted between Nov. 5 and Nov. 7, at roughly 25 $NEAR each, or about $90 per token.
The operators used liquidity pools on a decentralized exchange. Each token sat in its own pool paired with $NEAR, and about 117,000 stolen $NEAR moved through those pools. One set of wallets bought tokens with the stolen asset. Another set sold the same tokens back into the pool and took out real assets. Because the pool sat between them, no wallet sent funds directly to another. Receiving accounts could look like traders taking profits, not hack beneficiaries.
Elliptic said almost all turnover came from wallets tied to the operation. Outside buyers made up less than 1% of one token’s volume, and trading stopped by Nov. 8. One token used an Elon Musk image under a 2028 presidential banner, though Elliptic found no sign Musk was connected.
Larger Laundering Trail
The memecoin route is a small part of a bigger effort. Elliptic’s tracker follows stolen funds across more than 20,000 wallets on 16 blockchains, touching at least 36 services and about 65,000 transactions. Since Nov. 8, theft-linked wallets have deposited about 7,000 $ETH, worth near $15 million, into Tornado Cash.
Around 3,000 BTC, worth roughly $225 million, built up in newly created addresses after conversions from other stolen assets. The main Bitcoin and Ether holdings have not moved. About $3 billion remains in theft-linked addresses and $2.85 billion is frozen, with little likely cashed out. The FBI attributed the Oct. 29 theft to North Korea’s TraderTraitor group on Oct. 31 and urged services, including THORChain operators, to block linked transactions.
Breach and Recovery
Binance’s Nov. 3 account describes a months-long intrusion built on fake recruitment interviews and tampered developer software. During a September interview, an engineer downloaded an assignment repository onto a work computer, and malicious code replaced a legitimate development tool without tripping endpoint security. On Oct. 20, the attacker used that machine and an internal AI tool to reach two wallet engineers’ computers. Stolen container deployment credentials then opened access to wallet signing operations.
Binance put the impact at $6.34 billion and said it has set aside more than the full amount to cover losses. Recovery also runs through governance. About 8,425.997 $ETH and 74.56 million ARB frozen on Arbitrum can only move again with DAO approval, a process Binance estimates will take seven weeks or longer. The memecoin scheme shows the same pattern as earlier North Korean thefts: tracing slows but does not stop. Every hop sits on public ledgers. I think the root cause matters too. Binance’s post-mortem points to endpoint compromise through a poisoned development tool, not a leaked private key, so the fix leans on operational security rather than key rotation.
