North Korean hackers tied to the $6.3 billion Binance theft are trying a new way to move stolen funds: memecoins. Blockchain analytics firm Elliptic says the group created six tokens between Nov. 5 and Nov. 7 and used them to make illicit money look like trading profit.
Fake trading, real wallets
The hackers moved about 117,000 NEAR tokens, worth roughly $430,000, through the scheme. For each memecoin, they set up a liquidity pool paired with NEAR on a decentralized exchange. Then one set of wallets bought the memecoin with stolen NEAR, while another set sold the same token back for NEAR. The funds never moved directly from one wallet to the other. To an outside observer, the activity looks like successful memecoin trading rather than stolen assets being passed along.
Elliptic co-founder Tom Robinson said the launderers made six tokens and traded them only with themselves. That makes the stolen funds look like trading proceeds. The firm found that almost all trading came from wallets tied to the laundering scheme. Outside buyers made up less than 1% of one token’s volume. Trading across all six tokens stopped by Nov. 8.
Token names and outside buyers
The tokens followed common memecoin habits. One used an image of Elon Musk under an Elon 2028 President banner, though Elliptic said there is no suggestion Musk was connected to the tokens. Others used crude humor and the inu suffix common in dog-themed coins. The point was not to build a real community. It was to create enough market activity to justify where the NEAR came from.
The FBI has linked North Korea’s TraderTraitor group to the Oct. 29 Binance theft. The hackers have also used THORChain to convert stolen assets into bitcoin, which cannot be frozen by a central issuer. Elliptic says the memecoin trades make tracing harder, but they do not erase the trail.
Why the method matters
This is not the first time investigators have seen memecoin-based laundering. Elliptic identified a similar method after the 2025 Bybit hack. The pattern is becoming familiar, perhaps because memecoins are easy to create and decentralized exchanges offer quick liquidity. I think the tactic shows how attackers keep testing ways to break the chain between a hack and the final cash-out. For investigators, the work gets more complex, but wallet analysis can still connect the pieces. The stolen funds may look like trading gains on the surface. The underlying transfers are still there to follow.
