North Korean Hackers Use Memecoins to Launder Funds From…
North Korean hackers responsible for the October 29 Binance cryptocurrency theft have begun creating memecoins to launder stolen assets, using decentralized exchange liquidity pools to disguise transactions as legitimate trading activity. Blockchain analytics firm Elliptic revealed on November 9, 2026, that approximately 117,000 NEAR tokens, valued at $430,000, had moved through six newly created memecoins between November 5 and November 7. The activity forms part of a broader laundering operation following the theft of approximately $6.43 billion in cryptocurrency from Binance, described by blockchain investigators as the largest cryptocurrency theft on record.The Federal Bureau of Investigation attributed the attack to North Korea’s TraderTraitor hacking group on October 31, warning cryptocurrency businesses to block transactions connected to identified attacker-controlled wallets. Although the memecoin transactions represent a small fraction of the stolen assets, investigators say the technique demonstrates how attackers can exploit decentralized trading infrastructure to complicate transaction tracing.
Hackers Create Six Memecoins to Disguise Stolen Funds
According to Elliptic, the attackers created six memecoins on the NEAR blockchain, establishing individual liquidity pools for each token on decentralized exchanges. The tokens, identified as FUK, OLCCL, MEILI, MMLI, DABI and SINU, featured conventional memecoin branding, including animal illustrations and an image referencing Elon Musk. There is no evidence connecting Musk to the operation. The laundering mechanism involved two groups of wallets. The first purchased newly created memecoins using stolen NEAR, while the second sold those tokens through the same liquidity pools to receive NEAR.This arrangement prevented direct transfers between the original stolen-fund wallets and recipient addresses, making the proceeds resemble ordinary trading revenue. Elliptic found that the tokens attracted almost no genuine external trading activity, with the vast majority of transactions occurring between wallets associated with the laundering operation. Each token cost approximately 25 NEAR, or $90, to create. All six tokens had stopped trading by November 8, with several creators withdrawing their remaining liquidity. Investigators identified similar laundering activity involving newly created tokens on Tron and obscure cryptocurrency assets on Solana.
$2.85 Billion Frozen as Hackers Move Assets Across Blockchains
Elliptic’s broader investigation identified more than 20,000 wallets, 65,000 transactions and 36 cryptocurrency services involved in moving the Binance proceeds across 16 blockchains. Approximately $2.85 billion of the stolen assets had been frozen or seized, including stablecoins restricted by their issuers. Another $3 billion remained in addresses linked to the theft, predominantly in Bitcoin and Ethereum. By November 9, attackers had converted approximately $225 million of stolen cryptocurrency into Bitcoin, while roughly $15 million in Ethereum had entered Tornado Cash.Investigators also identified approximately $10 million in Bitcoin routed through coinjoin transactions. The laundering operation resembles techniques previously observed following the February 2025 Bybit hack, when North Korean-linked attackers moved at least $24 million through a newly created token on Tron. Despite the increasing complexity, Elliptic emphasized that these memecoin transactions remain visible on public blockchains. The technique complicates investigations but does not eliminate traceability. Importantly, movement through liquidity pools or privacy services does not necessarily establish that stolen assets have been converted into spendable cash. Elliptic estimates that only a negligible portion of the Binance proceeds has been successfully cashed out.
