CoinDesk
North Korean hackers used six homemade memecoins to launder 117,000 stolen NEAR, worth about $430,000, from the $6.3B Binance hack, according to Elliptic. The tokens were created between Nov. 5 and Nov. 7, then traded between wallets linked to the laundering operation to give the proceeds the appearance of legitimate trading profits. Trading across all six tokens stopped by Nov. 8.
Why it matters
Each memecoin was paired with NEAR in its own liquidity pool on a decentralized exchange. One group of wallets bought the tokens with stolen NEAR while another sold them back for NEAR, allowing the funds to move without a direct transfer between the trading wallets. Elliptic co-founder and chief scientist Tom Robinson said the objective was to make stolen funds look like trading proceeds.
Almost all volume came from wallets tied to the scheme, with outside buyers accounting for less than 1% of one token's volume. That concentration slowed investigators' efforts to separate real market activity from laundering, but it also left a trace that onchain analytics firms could identify.
Market impact
The activity shows how a technically simple market can be used to disguise the provenance of stolen crypto assets. The FBI has linked North Korea's TraderTraitor group to the Oct. 29 Binance theft, which has also involved converting stolen assets into bitcoin through THORChain, where central issuers cannot freeze the funds.
Elliptic identified a similar memecoin laundering method after the 2025 Bybit hack. The trades complicate tracing but do not erase the underlying onchain record, keeping asset-level analytics and exchange cooperation central to efforts to recover or constrain the stolen funds.
Frequently asked questions
-
How did the hackers use memecoins to launder stolen Binance funds?
They paired each memecoin with NEAR in liquidity pools, then used separate wallet groups to buy and sell the tokens. The circular trading made the stolen NEAR appear to be legitimate trading profit.
-
How much of the $6.3B Binance hack was moved through the memecoins?
The laundering activity involved 117,000 NEAR, worth roughly $430,000. The memecoin scheme covered only a small portion of the reported $6.3B theft.
-
Did outside investors participate in the six memecoins?
Almost all trading came from wallets tied to the laundering scheme. Outside buyers accounted for less than 1% of one token's volume.
-
Why did the memecoin scheme not erase the stolen funds' trail?
The hackers concentrated their trading in linked wallets, allowing Elliptic to identify the pattern. The activity slowed tracing but did not remove the transactions from the public onchain record.
-
What links North Korea to the Binance theft?
The FBI has pointed to North Korea's TraderTraitor group as responsible for the Oct. 29 theft. The hackers have also used THORChain to convert stolen assets into bitcoin, which cannot be frozen by a central issuer.
WuBlockchain
TheBlock
CryptoSlate