North Korean hackers even use meme coins to launder money! Blockchain analysis company Elliptic reveals suspected case of Binance$6.4 billion theftNorth Korea-related hackers actually issued at least 6 meme coins on their own and transferred approximately 117,000 NEAR through the decentralized exchange (DEX) liquidity pool, worth approximately US$430,000. There are almost no real buyers for these tokens. The purpose is not to profit from speculation, but to disguise stolen assets as general transaction income, making it more difficult to track funds on the chain.

6 meme coins are disposable and cost only $90 each to create

According to a Nov. 9 release from Ellipticinvestigation report, hackers created at least 6 meme coins on the NEAR blockchain between November 5 and 7, named FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each token costs about 25 NEAR to create, which is about $90 at the current price, and each establishes a liquidity pool paired with NEAR.

These tokens have extremely short transaction life cycles, often experiencing intensive trading within hours of issuance and then being abandoned. Elliptic noted that none of the six coins had seen trading activity since November 8, and the creators of four of the coins had withdrawn remaining pool liquidity.

There is little outside investor involvement in these meme coins. All the selling transactions of six tokens came from wallets controlled by the money laundering network; the buying transactions of five of them all came from the same network. The only small amount of external transactions came from FUK, accounting for less than 1% of the transaction volume.

The stolen money changes hands through the liquidity pool, disguised as normal transactions to make profits

Elliptic investigation pointed out that the attacker injected the stolen NEAR into the liquidity pool in exchange for newly created meme coins, and then another group of wallets sold the meme coins back to the pool and took out NEAR.In this way, there is no direct transfer between the wallet holding the stolen money and the final receiving wallet, making the flow of funds appear like a normal decentralized transaction.

According to on-chain data, the six meme coins transferred a total of approximately 117,000 NEAR, which was estimated to be approximately US$430,000 based on the price at the time of Elliptic’s release. Most of these funds were subsequently converted into stablecoins or transferred to cross-chain bridges.

Elliptic also found that for five of the six tokens, their creators had just received funds related to the previous token transaction 2 to 13 minutes before the token was issued, indicating that these tokens were not issued independently, but were a continuously operating fund transfer network.

However, this method cannot truly erase the transaction records on the blockchain. It can only slow down investigators' tracking of funds by adding layers of transactions.

FBI confirms North Korea's involvement, Binance's $6.4 billion theft still has a lot of stolen money flowing

This batch of funds is related to the major Binance hack that occurred on October 29.

According to an October 31 announcement from the FBI, authorities have attributed the theft of more than $6 billion to the North Korean-related hacker group TraderTraitor. Chainalysis estimates that the total value of stolen assets is approximately $6.4 billion. After the attacker succeeded, he quickly dispersed the funds through multiple blockchains, decentralized financial protocols and token exchange services.

According to Elliptic’s investigation updated on November 9, the relevant money laundering network has involved more than 20,000 wallets, 16 blockchains, at least 36 services and 65,000 transactions. Elliptic also pointed out that as of the time of its investigation, approximately 11.8 million of the stolen NEARs had not yet been moved, valued at approximately $43.7 million at the time.

A similar technique was used in the Bybit hack last year, with at least $24 million transferred

This is not the first time North Korean-related hackers have used self-issued tokens to hide the source of stolen money.

Elliptic says that in 2025 Bybit hackedAfter the incident, money launderers created tokens that lacked actual value on the TRON network, paired them with stablecoin liquidity pools, and conducted transactions through different wallets, thereby transferring at least US$24 million in stolen assets.

In this Binance incident, similar tactics also appeared on the TRON network, and Solana saw a variant that used low-liquidity existing tokens for fund conversion.

Elliptic emphasizes that these low-cost tokens are not enough to make funds truly disappear, but they can continuously increase the traceability process. For trading platforms and on-chain monitoring agencies, in the future, in addition to analyzing direct transfers, they will also need to track the complete source of funds entering and exiting the liquidity pool in order to identify money laundering activities behind seemingly normal transactions.

〈North Korean hackers create 6 meme coins to launder money! US$430,000 in stolen money transferred from Binance〉This article was first published inBlock Guest》.