North Korean hackers create memecoins to launder funds from Binance hack
Hackers associated with North Korea have begun using specially created meme coins to conceal the origin of cryptocurrency stolen during a large-scale hack of the Binance exchange in late October. With the help of such tokens, the attackers try to disguise the movement of funds as ordinary exchange operations.
The new scheme was reported by analytics firm Elliptic, which tracks transactions with crypto assets and investigates their use in financial crimes.
According to researchers, from November 5 to 7, hackers created at least six meme coins on the NEAR blockchain, through which they moved about 117,000 NEAR — approximately $430,000 at the then exchange rate.
The peculiarity of these tokens is that they were not intended for real trading or attracting investors. The attackers used them as a temporary tool to move stolen assets between different crypto wallets.
For this, the created tokens were added to liquidity pools on decentralized exchanges. One set of wallets exchanged the stolen cryptocurrency for meme coins, while another sold them, receiving real digital assets back.
As a result, no direct transfer between wallets associated with the theft of funds occurred. Outwardly, part of the transactions could look like ordinary trading in little-known cryptocurrencies.
Analysts established that almost all operations with the six meme coins were carried out by wallets connected to each other. The tokens were actively used for a short time, after which trading in them stopped. As of November 8, none of the six tokens was being traded anymore.
The creation of each such asset cost approximately $90. The low cost allowed the attackers to regularly launch new tokens and abandon previous ones after carrying out the necessary operations.
According to Elliptic, similar methods were also recorded on the Tron network. On Solana, hackers used a similar scheme, but utilizing existing low-liquidity tokens.
However, this scheme does not make the stolen funds invisible. All transactions remain on the blockchain and can be tracked. Yet additional operations complicate the analysis of asset movements and increase the time required to identify related wallets.
This method is not entirely new. In 2025, Elliptic detected its use after the hack of the Bybit crypto exchange. Then, through a specially created token on the Tron network, the attackers moved at least $24 million.
What is known about the Binance hack
On October 29, 2026, Binance suffered a massive cyberattack. According to Elliptic's estimate, the attackers stole crypto assets worth approximately $6.4 billion, making it the largest hack in the history of the cryptocurrency market.
The US Federal Bureau of Investigation officially attributed the attack to the North Korean hacker group TraderTraitor. In a statement on October 31, the FBI noted that the stolen assets were actively converted into Ethereum and moved through decentralized financial services.
Binance itself estimated the volume of assets affected by the incident at approximately $6.34 billion. According to the exchange as of November 3, about $2.85 billion of the stolen assets had been frozen or intercepted.
The company also stated that it would cover the financial consequences of the attack with its own funds. According to its data, as of October 31, reserves of 98% of the affected token assets were replenished. This does not mean that the corresponding share of the stolen cryptocurrency was recovered from the hackers.
The new scheme with meme coins is only a small part of the overall movement of stolen funds. However, according to Elliptic's assessment, its use creates additional difficulties for crypto exchanges and financial institutions that verify the origin of digital assets.
Analysts emphasize that the receipt of funds from liquidity pools does not in itself guarantee their legitimate origin. To detect suspicious operations, it is also necessary to analyze the history of token creation and connections between crypto wallets.
