North Korean hackers behind the $6.3 billion Binance theft have created their very own memecoins to disguise a part of the stolen cryptocurrency, utilizing faux buying and selling exercise to make illicit funds seem as reliable market proceeds.
The attackers moved roughly 117,000 NEAR tokens, value $430,000, via six newly created memecoins between November 5 and seven, based on blockchain analytics agency Elliptic. The scheme concerned buying and selling tokens between wallets below their management quite than transferring stolen belongings instantly, including complexity to efforts to hint the funds.
Six memecoins utilized in laundering scheme
Elliptic recognized six tokens: FUK, OLCCL, MEILI, MMLI, DABI and SINU. Their names and designs adopted typical memecoin traits, that includes animals, web humor and speculative themes. One displayed a picture of Elon Musk beneath an “Elon 2028 President” banner, though Elliptic discovered no proof of Musk’s involvement.
The hackers created separate liquidity swimming pools for every token, pairing them with NEAR on decentralized exchanges (DEXs). One group of wallets used stolen NEAR to buy the memecoins, whereas one other offered those self same tokens to obtain NEAR in return.
By routing transactions via liquidity swimming pools, the attackers prevented direct transfers between the wallets. The ensuing transactions seemed to be buying and selling proceeds quite than actions of stolen funds.
“The launderers made six of those crypto tokens, and traded them solely with themselves. That makes the stolen funds seem like buying and selling proceeds,” Elliptic co-founder and chief scientist Tom Robinson informed CoinDesk.
Virtually all buying and selling quantity got here from wallets linked to the laundering operation, with outdoors consumers accounting for lower than 1% of 1 token’s quantity. Exercise stopped by November 8, after which the attackers withdrew liquidity from 4 swimming pools. Every token reportedly price solely round 25 NEAR, or $90, to create.
North Korean Hackers Use Memecoins to Launder Funds From $6.3 Billion Binance Hack (Supply: X)
Laundering extends throughout a number of blockchains
The NEAR operation is a part of a broader technique. Elliptic additionally recognized related strategies on TRON and Solana.
On TRON, the attackers created a token and paired it with a stablecoin to generate synthetic trades. On Solana, they moved stolen SOL via low-liquidity tokens earlier than changing the belongings into USDC and transferring them throughout completely different blockchains. In contrast to the NEAR and TRON tokens, the Solana tokens already existed.
The method has precedent. Following the February 2025 Bybit hack, North Korean-linked hackers used an analogous methodology on TRON, making a nugatory token and buying and selling it in opposition to a stablecoin via managed wallets. Elliptic estimated that not less than $24 million in stolen funds handed via that association.
Though these transactions make investigations extra sophisticated, they don’t erase the blockchain path. Investigators can nonetheless study liquidity swimming pools and pockets exercise, however further transactions make it tougher and extra time-consuming to ascertain connections between addresses.
How the self-made memecoin scheme works. (Supply: Elliptic)
Greater than $3 billion stays linked to the theft
The laundering operation has concerned extra than simply memecoins. In its November 9 replace, Elliptic reported that the attackers had used over 20,000 wallets throughout 16 blockchains, interacted with not less than 36 providers and carried out greater than 65,000 transactions.
The hackers have mixed cross-chain bridges, decentralized exchanges, lending protocols and mixing providers to maneuver the stolen belongings.
Bitcoin has emerged as a serious vacation spot as a result of, in contrast to USDT and USDC, it can’t be frozen by a central issuer. By November 9, roughly 3,000 BTC, value $225 million, had been transformed from different stolen belongings and moved into new Bitcoin addresses.
The attackers additionally used CoinJoin transactions, which mix funds from a number of customers to obscure the hyperlinks between incoming and outgoing Bitcoin. Round 130 BTC, value roughly $10 million, had handed via these transactions by November 9.
One other route concerned Twister Money. Since November 8, the attackers had deposited roughly 7,000 ETH, value round $15 million, into the blending protocol.
Regardless of the intensive actions, Elliptic estimated that roughly $3 billion remained in addresses linked to the theft, primarily in Bitcoin and Ethereum holdings that had not but moved. Round $2.85 billion had been frozen or seized.
FBI hyperlinks Binance assault to North Korea’s TraderTraitor
The FBI has attributed the October 29 Binance theft to TraderTraitor, a hacking group linked to North Korea. The company printed addresses related to the operation and urged cryptocurrency platforms, DeFi protocols, bridge operators and different service suppliers to dam associated transactions.
The attackers have continued shifting between networks as particular person routes face restrictions. THORChain, which has facilitated conversions of stolen belongings into Bitcoin, briefly halted sure swaps through the laundering marketing campaign, prompting the hackers to discover various routes.
The case highlights the rising challenges dealing with cryptocurrency compliance groups. Monitoring direct pockets transfers is now not enough when stolen belongings can transfer via liquidity swimming pools, lending protocols and cross-chain providers.
Elliptic has printed a listing of addresses linked to the theft to assist companies display suspicious transactions. The agency additionally warns in opposition to routinely treating funds obtained via decentralized liquidity swimming pools as reliable buying and selling proceeds, significantly when newly created tokens and concentrated buying and selling exercise are concerned.
The usage of self-created memecoins illustrates how hackers can manufacture synthetic market exercise to disguise illicit funds. Whereas the approach doesn’t get rid of transaction data, it provides one other layer to an already complicated laundering operation involving billions of {dollars} in stolen cryptocurrency.
