North Korea's money launderers are creating throwaway memecoins to obscure funds stolen in the Binance hack, according to blockchain analytics firm Elliptic. About $430,000 in stolen NEAR moved through six tokens that were later abandoned, a tactic also used after the 2025 Bybit hack.
Launderers tied to North Korea are spinning up throwaway memecoins to help obfuscate funds stolen in the $6.4 billion Binance hack, according to Elliptic. The firm said in a report released Monday that about 117,000 NEAR, worth roughly $430,000 at the time, went into six newly created tokens made between Nov. 5 and Nov. 7.
How the memecoin swaps hide the trail
Like many other memecoins, the tokens feature animal mascots, and one carries an expletive ticker. Another features Elon Musk, though Elliptic added that there was no suggestion Musk himself was linked to it.
The launderers can then use decentralized exchange liquidity pools to separate wallets holding stolen funds from wallets taking in proceeds. One set of wallets will buy the memecoins with stolen NEAR, while another sells the token into the pool and collects NEAR in return. Because the pool sits in between, to a casual observer the collecting wallets look like ordinary traders who sold a token at a profit, Elliptic wrote.
The tokens have all since been abandoned, and much of the NEAR collected went into stablecoins or cross-chain bridges, Elliptic said.
Same tactic as the Bybit laundering
Elliptic noted that launderers moved around $24 million through a homemade token paired with a stablecoin on Tron following the 2025 Bybit hack. In the Binance case, the firm also found evidence of a similar approach on Solana using existing tokens with low liquidity.
The transfers remain public and traceable on the blockchain. Elliptic said the additional swaps are only meant to slow investigators down, giving launderers a little extra time to move funds before their wallets get flagged.
The amounts moved through the six NEAR tokens are still small compared to 11.8 million NEAR worth around $42.7 million at current prices. Elliptic's update from Friday tracked roughly $124 million in stolen assets converted into bitcoin.
Source: The Block
Trading involves risk.
Risk Disclaimer
