North Korea Is Minting Its Own Meme Coins to Launder Binance Hack Loot
North Korean launderers are creating their own temporary meme coins on the NEAR blockchain to obscure the movement of funds stolen in the recent Binance hack, a tactic identified by blockchain analytics firm Elliptic.
Intelligence analysis by Gemini 2.5 Flash
The laundering technique involves minting new, worthless meme tokens, pairing them with real assets like NEAR in homemade liquidity pools, then buying these tokens with stolen funds from one wallet and selling them from a second wallet. This indirect transfer makes it harder for investigators to trace the direct flow of illicit funds.
Imagine someone stole a big pile of shiny coins. Instead of just giving them to a friend, they quickly make up some silly, worthless toy coins. They then pretend to trade their stolen shiny coins for these toy coins, and then another friend pretends to sell the toy coins back for shiny coins. It looks like a normal trade, but it's just a trick to make it super confusing to figure out where the original stolen coins went, giving them time to run away with the real money.
Analysis
TraderTraitor
North Korea's state-sponsored hacking group, known as TraderTraitor, has been identified by the FBI as responsible for the substantial Binance theft that occurred on October 29. This group has a history of employing innovative and complex methods to launder stolen cryptocurrency, consistently adapting its tactics to evade detection by blockchain analytics firms. The use of throwaway meme coins represents a further evolution in their operational security, aiming to create additional layers of obfuscation in their illicit financial flows.
Elliptic, a prominent blockchain analytics firm, has been instrumental in tracking the activities of TraderTraitor, linking them to multiple high-profile crypto exploits. Their ongoing monitoring reveals a persistent and well-funded effort by the North Korean regime to generate revenue through cybercrime, with the cumulative known total of their crypto thefts exceeding $6 billion even before the Binance incident. This underscores the significant threat posed by such state-backed actors to the broader cryptocurrency ecosystem and global financial security.
117,000 NEAR
Between November 5 and 7, approximately 117,000 NEAR tokens, valued at around $430,000, were funneled through six newly minted meme tokens on the NEAR blockchain. These tokens, with names like FUK, OLCCL, and SINU, were created specifically for the purpose of laundering, each costing about 25 NEAR (roughly $90) to establish. The process involved rapidly trading these tokens within hours of their creation using stolen NEAR, effectively washing the funds through temporary liquidity pools before the tokens were abandoned.
The rapid creation and abandonment of these meme coins serve a critical function for the launderers: buying time. While every transaction remains public on the blockchain, each additional hop in the laundering chain slows down investigators, giving the perpetrators a window to move funds further before they are flagged and blacklisted. This tactic, though not a disappearing act, significantly complicates the efforts of law enforcement and analytics firms to track and freeze the stolen assets, highlighting the cat-and-mouse game between criminals and security experts.
Bybit
This isn't the first time North Korean groups have employed such a technique. Elliptic previously reported a similar approach in the laundering of funds from the February 2025 Bybit theft, which was also attributed to the TraderTraitor group. In that instance, a worthless Tron token was utilized to move at least $24 million, demonstrating a consistent pattern of leveraging obscure or newly created tokens across different blockchains to facilitate money laundering operations. The recurrence of this method indicates its effectiveness from the perspective of the perpetrators.
The firm has observed variants of this technique on other blockchains as well, including Tron and Solana, where existing thinly traded tokens were sometimes used instead of homemade ones. This adaptability across various platforms and token types showcases the sophistication and resourcefulness of North Korea's crypto theft machine. The ongoing challenge for investigators is to develop countermeasures that can keep pace with these rapidly multiplying and evolving laundering tactics, ensuring that blocklists and tracking mechanisms can effectively catch up to and neutralize these illicit financial flows.
Key points
- North Korean launderers are using self-created meme coins on the NEAR blockchain to obscure stolen Binance funds.
- The technique involves creating temporary tokens, pairing them with real assets in liquidity pools, and trading them between wallets to avoid direct transfers.
- Approximately 117,000 NEAR tokens, valued at $430,000, were laundered through six such meme coins between November 5-7.
- This method, previously seen in the 2025 Bybit theft, aims to buy time for launderers by slowing down investigators.
- The FBI attributes the $6.34 billion Binance theft to North Korea's TraderTraitor group, highlighting a persistent state-sponsored cybercrime threat.
Despite the sophisticated laundering techniques, blockchain analytics firms are actively tracking these illicit flows, leading to a significant portion of the stolen funds being frozen. Binance has also committed to covering customer losses from its own funds, offering a degree of protection to affected users and demonstrating resilience in the face of such attacks.
The continuous evolution of North Korean laundering tactics, such as the use of throwaway meme coins, poses an ongoing and escalating challenge for blockchain security and law enforcement. These methods buy critical time for criminals, making it increasingly difficult to trace and recover stolen assets before they are fully laundered and cashed out.
