North Korea-Linked Hackers Create Fake Memecoins to Launder Stolen Binance Funds

North Korea-linked launderers are minting their own memecoins to move stolen crypto, and blockchain analytics firm Elliptic has now traced the trick in detail. Between 5 and 7 November, wallets tied to the October theft from Binance created at least six throwaway tokens on NEAR, paired each one with NEAR in a liquidity pool, and moved about 117,000 NEAR through them, roughly $430,000 by Elliptic's estimate.

• The news: Elliptic says launderers tied to the Binance theft minted at least six homemade memecoins on NEAR between 5 and 7 November to move stolen funds.
• The figure: About 117,000 NEAR, roughly $430,000 by Elliptic's estimate, moved through the six tokens created between 5 and 7 November.
• What happens next: Elliptic keeps updating its public Binance hack blocklist as it finds new wallets, and says firms must recheck deposits they have already accepted.

Six Tokens Minted in Three Days

The tokens look like a joke. Their logos include a monkey wearing a pink bow, a duck in front of a US flag, a chimpanzee, a fox, a flaming gold badge, and an image of Elon Musk under an "Elon 2028 President" banner. Elliptic says Musk has no connection to any of them.

The order of creation is precise. FUK went live at 00:25 UTC on 5 November. OLCCL, MEILI, MMLI and DABI followed on 6 November, between 07:19 and 14:27 UTC. SINU was created at 10:06 UTC on 7 November.

None of the six has traded since 8 November. On the afternoon of that day, the creators of four of them withdrew the liquidity that was left in their pools.

How a $90 Token Moves Stolen NEAR

Each token cost about 25 NEAR, around $90, to create, and every one was paired with NEAR in its own pool, an automated swap booth on a decentralized exchange. The pairing is the point: the pool lets the launderers swap one form of stolen NEAR for another while the token itself does nothing.

The buying wallets for all six tokens were funded with stolen NEAR, about 117,000 NEAR in total, passed down from the main stolen-NEAR wallet through intermediate accounts. Almost exactly the same amount left the collecting wallets soon afterwards, much of it converted into stablecoins or sent to a cross-chain bridge.

Each token was paid for out of earlier laundering. Five of the six creators were funded by a wallet that had just been selling an earlier token, between 2 and 13 minutes before the next launch.

Nobody outside the operation traded them. Elliptic found that wallets in the network made every sale of all six tokens and bought every unit of five of them. The only outside activity was a handful of small FUK purchases on its first day, less than 1% of its volume.

That is why the tokens are made to be used once and thrown away. With no outside buyers, the price is whatever the launderers choose to set.

The Same Trick on Tron and Solana

In the $6.4 billion Binance case Elliptic says it has seen this technique on Tron and NEAR, along with a closely related approach on Solana. It first reported the method in the laundering of funds stolen from Bybit in 2025, where the same trick moved at least $24 million.

On 2 November, Elliptic identified a worthless token on Tron created solely to launder funds. The following day, stolen SOL was swapped into wrapped and thinly traded tokens on Solana before being sold for USDC and moved to other blockchains.

Both the Bybit theft and the Binance heist are attributed to TraderTraitor. We have explained who that group is and how its wallet network has been spreading the loot.

Less Than 1% of the Loot, and a Growing Blocklist

Elliptic's numbers show how little of the Binance haul this route has moved so far. About 11.8 million NEAR, worth $43.7 million by its estimate, from the theft has not moved yet, and the memecoin route has handled less than 1% of that pile.

Across the whole laundering operation since the theft, Elliptic counts more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions. It says the stolen funds were spread over 11 different blockchains after the 29 October theft.

To help firms keep pace, Elliptic maintains a public Binance hack blocklist and updates it as it identifies new wallets. Because that list keeps growing, deposits a firm has already accepted need to be checked again.

What the FBI Wants Blocked

The FBI has blamed North Korea for the theft, saying more than $6 billion in virtual assets was taken from Binance on or about 29 October 2026, activity it calls TraderTraitor. Elliptic puts the same theft at $6.43 billion, spread over 11 blockchains. The two figures do not match, and neither is settled.

In its public alert, the FBI says that with the US Secret Service and IRS Criminal Investigation it has observed TraderTraitor actors converting stolen assets mainly into Ether. It is asking THORNode operators, RPC node operators, instant exchanges, DeFi services, analytics firms and other virtual asset service providers to block transactions with, or derived from, the addresses being used to launder the funds.

For now the memecoin route is a rounding error against the $43.7 million still sitting in stolen NEAR. The test is whether fresh NEAR tokens appear after 8 November, and whether the wallets behind the first six stay visible on a blocklist that keeps growing.