Key Takeaways
Linked wallets managed practically all buying and selling within the disposable tokens.Launderers recycled sale proceeds to finance new token launches.Stolen belongings transformed into bitcoin reached about $225 million.
Meme Cash Complicate the Binance Hack Path
North Korean launderers used meme cash and obscure tokens on Tron, Solana, and Close to, Elliptic co-founder and chief scientist Tom Robinson defined on Nov. 9. Tron and Close to concerned newly created cash; Solana relied on current belongings.
Robinson wrote:
“Most individuals consider meme tokens as joke cash whose costs rise and fall on hype. North Korea’s launderers have discovered a unique use for them, creating tokens that no person else needs to purchase and utilizing them to disguise the motion of stolen funds.”
On Close to, one group purchased the brand new cash with stolen cryptocurrency via token liquidity swimming pools. Different wallets offered into the identical swimming pools and picked up practically matching proceeds, separating the sending and receiving addresses.
Six tokens created between Nov. 5 and Nov. 7 dealt with about 117,000 NEAR ($430,000), with virtually no exterior buying and selling. Every launch price about $90. 5 creators obtained funding from earlier token gross sales shortly earlier than launching replacements.
The Federal Bureau of Investigation (FBI) attributed final month’s Binance theft to North Korea on Oct. 31, figuring out the operation as Tradertraitor, a state-sponsored North Korean group focusing on cryptocurrency companies.
Nonetheless, North Korea denied accountability for the hack on Nov. 3. Kim Yo-jong, sister of North Korean chief Kim Jong Un, referred to as the FBI’s accusations a “grave political provocation” meant to break the nation’s status.
Binance Theft Triggered a Race In opposition to Freezes
Stolen belongings from the Oct. 29 Binance assault blended with proceeds from September’s Bitget theft, Chainalysis discovered. The agency cited this overlap in attributing the Binance theft to Tradertraitor. Its evaluation drew on blockchain exercise noticed within the hours after the assault.
The attacker tried to evade freezes via speedy stablecoin conversions, exchanging $325 million in funds for roughly $285 million in ether over practically 20 minutes. Ether lacks the issuer-controlled freezes accessible for these stablecoins.
Elliptic flagged a nugatory Tron token created solely for laundering on Nov. 2, and stolen solana moved via thinly traded tokens the subsequent day. Elliptic beforehand traced not less than $24 million via an identical scheme after the 2025 Bybit theft.
Explaining the layered strategy, Robinson said:
“North Korea’s launderers hardly ever depend on a single method. As a substitute, they layer many low cost strategies, every including slightly extra delay. Home made meme tokens are merely yet one more layer.”
Hundreds of Wallets Lead Into Bitcoin
By Nov. 2, stolen belongings had handed via roughly 12,000 wallets throughout 11 blockchains. Mounted timing and blind retries of failed operations with out adjustment indicated typical automation. Elliptic discovered no proof of AI-directed selections.
A Nov. 7 replace counted greater than 20,000 wallets, 16 blockchains, and not less than 65,000 transactions. Elliptic tracked conversions into roughly 2,300 bitcoin, price $175 million then, from belongings together with solana, XRP, and tron.
Transformed proceeds reached about 3,000 bitcoin, price $225 million by Nov. 9. Elliptic additionally traced roughly 7,000 ether (about $15 million price) into Twister Money, a mixer permitting pooled deposits to be withdrawn to totally different addresses. The agency estimated that solely a negligible quantity had probably been cashed out.
On publicity via buying and selling swimming pools, the Elliptic chief scientist warned:
“A pockets that obtained its funds from a liquidity pool shouldn’t be handled as clear by default, as it could sit simply two swaps away from stolen funds.”
