North Korean hackers are turning meme coins into a cheap, effective way to shuffle stolen crypto — and blockchain sleuths say the trick is already being used to launder part of the $6.4 billion pilfered from Binance. Blockchain analytics firm Elliptic, in research credited to co-founder Tom Robinson, describes a simple but clever method that obscures the direct on‑chain path between thief wallets and the wallets collecting the proceeds. The technique has been deployed on Tron and Near, with a close variant spotted on Solana. How the scheme works - Attackers mint brand‑new meme tokens and create a liquidity pool pairing the token with a real asset (e.g., NEAR or a stablecoin). - Stolen funds are routed into the pool via one set of wallets to buy the newly minted token. - A separate set of wallets then sells that token back into the pool, withdrawing clean‑looking assets. - Because the pool sits between buyer and seller, no funds move directly from the thief’s wallet to the collector’s wallet — making the receiver appear like an ordinary trader cashing out a meme coin. Concrete example on Near Between Nov. 5–7 Elliptic found at least six disposable tokens launched on Near, each paired with NEAR in its own pool. The coins had typical meme aesthetics — cartoon monkeys, a flag‑draped duck, a fox, and even an “Elon 2028 President” image (despite Elon Musk having no connection to the tokens). Names ranged from crude (FUK) to dog‑coin riffs (SINU). Each token cost roughly 25 NEAR (about $90) to create. The pattern was fast and disposable: tokens launched, experienced intense trading within hours using stolen NEAR, and were abandoned as liquidity was pulled on Nov. 8. In total about 117,000 NEAR — roughly $430,000 — flowed through those six tokens before much of it moved into stablecoins or across a bridge. What this means - The sums laundered via these meme tokens are modest so far, and Elliptic notes the bulk of the $6.4 billion theft remains parked on‑chain. The firm previously found over $3 billion of the stolen funds had yet to be laundered. - Launderers are operating at machine speed: Elliptic observed them spinning up new wallets roughly every 25 seconds to move money quickly. - Crucially, the meme‑coin maneuver does not erase the on‑chain trail. It primarily complicates and slows investigators, buying time for criminals as one disposable layer among many. Context and compliance takeaways Elliptic first spotted the tactic last year while tracing a $1.5 billion Bybit theft attributed to the TraderTraitor group — the same actors linked to the Binance breach. The firm warns compliance teams not to assume funds exiting a liquidity pool are “clean,” especially when freshly minted tokens and a small number of trading wallets are involved. The meme‑coin laundering playbook is low cost, fast to execute, and deliberately ephemeral — a reminder that as decentralized finance tools proliferate, so do creative methods for moving illicit proceeds. Read more AI-generated news on: https://app.chaingpt.org/news