North Korean hackers create memecoins to launder funds from Binance hack: Elliptic
North Korean hackers used newly created memecoins on the NEAR blockchain to launder approximately $430,000 stolen from the $6.4 billion Binance hack, according to blockchain analytics firm Elliptic.
Intelligence analysis by Gemini 2.5 Flash
A report by Elliptic reveals that state-sponsored hackers created six short-lived memecoins on the NEAR blockchain between November 5 and 7. They exploited liquidity pools on decentralized exchanges to swap stolen NEAR tokens for these new memecoins, then sold them back, effectively obscuring the movement of funds between wallets without direct transfers.
Imagine someone stole a big pile of special digital coins. To hide them, they didn't just move them from one pocket to another. Instead, they quickly made up some silly, new, temporary digital coins, like making up a game with fake money. They swapped their stolen coins for these fake ones, then immediately swapped the fake ones back for different real coins in a new place. This made it super tricky to follow where the original stolen coins went, like trying to track a ball that keeps changing colors and bouncing between many hands.
Analysis
North Korean hacking groups, known for their persistent efforts to illicitly acquire and launder cryptocurrency, have once again demonstrated an adaptive approach to financial crime. The recent findings by blockchain analytics firm Elliptic detail a novel method involving the creation of ephemeral memecoins on the NEAR blockchain to obfuscate the trail of stolen assets. This strategy underscores the continuous cat-and-mouse game between cybercriminals and blockchain forensic experts, with hackers constantly seeking new vulnerabilities and techniques to exploit the decentralized nature of digital finance.
NEAR Tokens
The laundering operation specifically targeted NEAR tokens, which were part of the proceeds from the substantial $6.4 billion Binance hack. Hackers established at least six distinct memecoins on the NEAR blockchain, utilizing decentralized exchange liquidity pools as a crucial intermediary. This technique involved swapping stolen NEAR for the newly minted memecoins, then immediately selling those memecoins back into the pools for fresh NEAR tokens from different wallets. This layering of transactions through temporary, low-liquidity assets effectively added complexity and delay to the tracing process, making it harder for automated systems to follow the money trail directly.
Elliptic
Blockchain analytics firm Elliptic played a pivotal role in uncovering this intricate laundering scheme. Their report meticulously traced the flow of approximately $430,000 through these newly created tokens, linking the funding of token creators to earlier illicit proceeds. Elliptic co-founder Tom Robinson noted that North Korean launderers frequently employ multiple, inexpensive techniques to add layers of obfuscation. The firm also highlighted a similar pattern following the $1.5 billion Bybit hack in 2025, where North Korean-linked actors moved at least $24 million using a newly created token on the TRON blockchain, indicating a recurring and evolving methodology in their illicit financial operations.
Binance Hack
The funds laundered through these memecoins originated from the massive $6.4 billion Binance hack, a significant event in the history of cryptocurrency security breaches. While $430,000 represents a fraction of the total stolen amount, it illustrates the persistent efforts by the perpetrators to convert their ill-gotten gains into usable assets. At the time of Elliptic's analysis, a substantial portion, approximately 11.8 million NEAR tokens valued at $43.7 million, from the Binance hack remained unmoved. This ongoing challenge of recovering or freezing stolen assets underscores the long-term implications of such large-scale breaches and the continuous need for enhanced security measures and forensic capabilities within the crypto ecosystem.
Key points
- North Korean hackers laundered $430,000 from the $6.4 billion Binance hack using newly created memecoins on the NEAR blockchain.
- The hackers utilized liquidity pools on decentralized exchanges to swap stolen NEAR tokens for new memecoins, then sold them back to obscure fund transfers.
- Blockchain analytics firm Elliptic traced the transactions, noting the technique adds layers of delay and complexity to tracing illicit funds.
- A similar laundering method was previously observed following the $1.5 billion Bybit hack in 2025, involving the TRON blockchain.
- Approximately 11.8 million NEAR tokens, valued at $43.7 million, from the Binance hack remained unmoved at the time of Elliptic's analysis.
The continued use of sophisticated laundering techniques by state-sponsored actors like North Korea poses a significant and evolving threat to the integrity and security of the cryptocurrency ecosystem. This trend suggests that despite advancements in blockchain analytics, criminals will likely continue to innovate, making it increasingly difficult for law enforcement and security firms to track and recover stolen digital assets.
