A report published yesterday (11/9) by blockchain analytics firm Elliptic said that the Binance hack at the end of October, which resulted in the loss of about $6.4 billion in crypto assets, involved a relatively novel money-laundering method: North Korean money launderers issued meme coins that almost nobody bought and used liquidity pools to move the stolen funds.
North Korean hackers created their own meme coins to avoid transferring stolen funds directly
Elliptic said the meme coins were intended for one-time use, with their prices set by the money launderers themselves, and almost nobody else bought them. The laundering process then proceeded as follows:
To carry out the operation, they first used publicly available token-creation tools to create new tokens, paired them with real assets such as NEAR or stablecoins, and opened liquidity pools on decentralized exchanges.
One batch of wallets used stolen funds to buy tokens, while another batch sold the tokens back into the same pool and withdrew real assets.
The stolen funds therefore never moved directly from the buying wallets to the receiving wallets, making the receiving wallets look like ordinary traders who had profited by selling tokens.
Elliptic noted that large numbers of meme coins are created every day, and most are quickly ignored. Another short-lived token is unlikely to attract attention, and wallets with a history of meme coin trading can easily be mistaken for speculators.
A series of cases, from Tron to NEAR
Elliptic said the method first appeared in the 2025 Bybit hack. At the time, money launderers issued worthless tokens on the Tron blockchain and transferred at least $24 million. Both that incident and the latest Binance incident have been attributed to TraderTraitor, which is believed to be part of the Lazarus Group.
Similar tokens were found on Tron on November 2 this time around, and on November 3, stolen SOL was exchanged for an existing, thinly traded token, with the same aim.
Transactions on the NEAR blockchain also provided a complete record of North Korean money launderers’ activity.
Elliptic identified at least six meme coins launched between November 5 and 7: FUK, OLCCL, MEILI, MMLI, DABI, and SINU. Each cost about $90 to create. Buying wallets received a total of about 117,000 NEAR in stolen funds, worth approximately $430,000. Almost the same amount then flowed out of the receiving wallets, with most converted into stablecoins or sent to cross-chain bridges.
Elliptic believes these tokens were created specifically for money laundering. Its reasons include that all sales and nearly all purchases came from wallets in the laundering network, and that each token saw its first sale within three hours of launch.
Money-laundering trails remain traceable; firms should reassess
Elliptic noted that every step remains on the blockchain. This method only slows investigations; the funds’ trail can still be tracked.
Stolen funds passed through tokens and liquidity pools, taking several extra steps. Investigators must untangle each layer to confirm that the money in receiving wallets actually came from stolen funds. Money laundering is a race against time: funds are easier to cash out if moved before they are flagged as stolen, so slowing investigations benefits launderers.
The amount currently being moved through meme coins is limited, but the approximately 11.8 million stolen NEAR (worth about $43.7 million) has not yet been moved. For hackers, however, this method is very cheap and can handle much larger sums.
Elliptic advises compliance teams not to assume that funds from liquidity pools are clean, especially when newly created tokens are involved. Warning signs include only a small number of wallets trading in a pool and new wallets receiving funds shortly before trading. Firms can also compare transactions against the public blacklist of addresses related to the Binance hack published by the company, and review funds already received as the list expands.
The report also noted that North Korean money launderers tend to combine multiple low-cost techniques; creating their own meme coins is just one part of the process.
In addition, although the US FBI and several cybersecurity firms have linked the Binance hack to a hacker group cultivated by North Korea, Kim Yo Jong, the sister of North Korean leader Kim Jong Un and a senior Workers’ Party official, denied the allegation. She stressed that Pyongyang had no reason to sit down for talks with the US unless it abandoned its hostile policy toward North Korea.
Related reading:
Tracking money laundering from the Binance hack: A new wallet created every 25 seconds across 11 chains, with no evidence of AI involvement
How the Binance hackers laundered funds: An unprecedented pattern emerged, with $5 million worth of tokens dumped for just $71
The article ‘North Korean hackers who stole $6.4 billion from Binance launder money by issuing meme coins nobody cares about—these six coins were all tools of the crime’ was first published on ‘Crypto City’