North Korea’s Binance Launderers Are Minting $90 Memecoins to Move Stolen Funds

North Korean launderers handling the $6.4 billion Binance theft have started minting their own memecoins to move stolen funds, according to a November 9 report from blockchain analytics firm Elliptic.

The method is cheap and fast. Each token cost about 25 NEAR, or roughly $90, to create. Elliptic says about 117,000 stolen NEAR, worth around $430,000, passed through six of these home-made tokens between November 5 and 7.

The sums are small next to the size of the heist. But the case offers a rare, detailed look at how modern crypto money laundering works, and why it still leaves a trail that investigators can follow.

How the Memecoin Trick Works

Elliptic co-founder Tom Robinson described a four-step process. First, the launderers create a new token with a public token-launch tool. Next, they pair it with a real asset, such as NEAR or a stablecoin, in a decentralized exchange liquidity pool.

Then one set of wallets pays stolen funds into the pool and receives the new token. A second set of wallets sells the token back into the same pool and withdraws the real asset.

“At no point do the stolen funds move directly from a buying wallet to a collecting wallet, because the pool sits in between,” Robinson wrote. To a casual observer, the collecting wallets look like ordinary traders who sold a token at a profit.

The tokens borrow the look of real memecoins. Their logos include a monkey with a pink bow, a duck, a chimpanzee, a fox and an image of Elon Musk under an “Elon 2028 President” banner. Elliptic stressed there is no suggestion Musk has any link to them.

Six Tokens in Three Days

The NEAR activity gives the clearest view so far. FUK was created at 00:25 UTC on November 5. OLCCL, MEILI, MMLI and DABI followed on November 6, all between 07:19 and 14:27 UTC. SINU appeared at 10:06 UTC on November 7.

Every token followed the same pattern. It was created, traded heavily within hours using stolen NEAR, and then abandoned. None of the six has traded since November 8, when the creators of four of them withdrew the liquidity left in their pools.

Elliptic found three signs that the tokens existed only for laundering. Wallets in the network made every sale of all six tokens and bought every unit of five of them. Outside buying was limited to a few small purchases of FUK, under 1% of its volume.

The tokens were also chained together. Five of the six creators were funded by a wallet that was already selling an earlier token, between 2 and 13 minutes before each new launch. In every case, the stolen NEAR that went in matched the NEAR that came out.

A Tactic First Seen After Bybit

This is not a new invention. Elliptic first reported the technique during the laundering of funds stolen from Bybit in 2025, when a worthless Tron token paired with a stablecoin moved at least $24 million.

The Binance launderers returned to the idea within days. On November 2, Elliptic spotted a purpose-built token on Tron. On November 3, stolen SOL was swapped into thinly traded existing tokens on Solana before being sold for USDC and moved to other blockchains.

The FBI publicly attributed the Binance theft to North Korean hackers on October 31, naming the activity “TraderTraitor.” The bureau, working with the Secret Service and IRS Criminal Investigation, said it expected the funds to pass through DeFi platforms and instant swap services. Anyone with information can report it through the FBI’s Internet Crime Complaint Center.

Small Amounts, Big Warning

So far, the memecoin route has handled only a sliver of the stolen NEAR. Elliptic says about 11.8 million NEAR, worth roughly $43.7 million, from the theft has not yet moved.

That means the 117,000 NEAR pushed through the six tokens equals roughly 1% of what is still sitting idle. The concern is scale. A $90 token can carry far larger sums, and launderers can create as many as they need.

Recovery work continues on other fronts. We have covered Binance’s effort to reclaim frozen ETH on Arbitrum and its move to restore HYPE and APT services after the attack.

Why the Trail Stays Visible

The most important point in Elliptic’s report is that the trick does not make funds disappear. “The trail can still be followed on-chain,” it said. The technique slows investigators down rather than hiding the money.

That is a strength of public blockchains. Every swap, pool deposit and withdrawal is recorded where anyone can inspect it. Bitcoin’s transparent ledger works the same way, which is why stolen coins are so hard to cash out quietly at scale.

Robinson described North Korea’s approach as layering. “North Korea’s launderers rarely rely on a single technique,” he wrote. “Instead, they layer many cheap techniques, each adding a little more delay.” Speed matters because laundering is a race to move funds before they are flagged.

Red Flags for Exchanges and Traders

Elliptic urged compliance teams not to treat funds from a liquidity pool as clean by default. Warning signs include a token created in the last few days, a pool where only a handful of wallets trade, and wallets that only buy while others only sell.

New wallets funded shortly before trading, often in round amounts, are another signal. Elliptic also advised firms to re-check deposits they have already accepted as blocklists grow.

For ordinary traders, the lesson is simple. A brand-new token with a cute logo and sudden volume may not be a hidden gem. In some cases, it may be a laundering tool, and buying in could expose funds to freezes.

The wider industry has shown it can respond quickly to exploits, as seen in Solana’s move to phase out durable nonces after the Drift hack. Faster tracing and shared blocklists are now the main tools for keeping stolen funds from reaching cash.