In brief
- North Korea’s launderers are creating home-made meme coins and swapping stolen Binance funds through decentralized-exchange liquidity pools so no funds move directly between thief and recipient wallets, Elliptic found.
- The clearest case appeared on Near, where six disposable tokens (with logos including a monkey, a duck and Elon Musk) each cost around $90 to mint.
- The amounts are small against the $3 billion-plus still unlaundered, and the trail stays traceable—it just buys time, a technique Elliptic first saw in the 2025 Bybit theft.
North Korea’s hackers have found a novel use for the internet’s favorite joke tokens: laundering a slice of the record $6.4 billion stolen from Binance.
According to a report from blockchain analytics firm Elliptic, the launderers are creating their own worthless meme coins and using them to shuffle stolen funds through decentralized exchanges in a way that breaks the direct onchain link between the thief’s wallet and the one collecting the proceeds.
The launderers mint a brand-new token, pair it with a real asset like Near or a stablecoin in a liquidity pool, pay stolen funds into the pool through one set of wallets to buy the token, then sell it back through a separate set of wallets to withdraw clean-looking assets.
Because the pool sits in the middle, no stolen funds move directly from the buying wallet to the collecting one, and the receiving wallets look like ordinary traders cashing out a meme coin.
Elliptic, in research credited to co-founder Tom Robinson, said the launderers deployed the tactic on Tron and Near, with a close variant on Solana. The clearest example came on Near, where between Nov. 5 and 7 they created at least six home-made tokens, each paired with Near in its own pool.
The coins carried the usual meme-coin trappings: cartoon logos of a bow-wearing monkey, a flag-draped duck, a chimpanzee and a fox, one even featuring an “Elon 2028 President” image of Elon Musk, who has no connection to the tokens. The names ran from the crude (FUK) to a riff on dog coins (SINU).
Each token cost about 25 Near tokens, roughly $90, to create. All six followed the same arc: launched, traded heavily within hours using stolen NEAR, then abandoned, with the leftover liquidity pulled on Nov. 8.
→In total, about 117,000 Near, or roughly $430,000, passed through the six tokens before much of it flowed into stablecoins or a cross-chain bridge.
The sums are modest so far, a reminder that the bulk of the haul is still parked onchain. Elliptic earlier found more than $3 billion of the stolen crypto had yet to be laundered, and that the launderers were spinning up a new wallet roughly every 25 seconds to move funds at machine speed.
Crucially, the meme-coin trick doesn’t actually hide the money. Elliptic stressed the trail remains fully traceable onchain; the maneuver only slows investigators down, buying time in what is essentially a race to move funds before they get flagged.
It’s one cheap, disposable layer among many that North Korea’s launderers stack together. Elliptic first observed the tactic last year while tracing the $1.5 billion Bybit theft, also attributed to the TraderTraitor group behind the Binance breach.
For compliance teams, the firm warned, funds arriving from a liquidity pool shouldn’t be assumed clean, especially where freshly minted tokens and a handful of trading wallets are involved.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Join 72,000+ readers