North Korea Is Minting Its Own Meme Coins to Launder Binance Hack Loot
North Korean launderers created at least six worthless meme coins on the NEAR blockchain to move stolen Binance funds, avoiding direct wallet transfers, blockchain analytics firm Elliptic reported Monday.
Between Nov. 5 and 7, the operators minted six new tokens on the NEAR blockchain — named FUK, OLCCL, MEILI, MMLI, DABI and SINU — paired each with NEAR in its own liquidity pool, then bought the tokens with stolen NEAR and sold them back out through a second set of wallets. About 117,000 NEAR, or roughly $430,000, passed through these six tokens.
This laundering operation sits within the broader Oct. 29 Binance theft, which the exchange has valued at $6.34 billion and which the FBI has attributed to North Korea's TraderTraitor group. Elliptic's analysis shows that roughly 3,000 BTC — about $225 million — has been converted into new bitcoin addresses, while about 11.8 million NEAR, or $43.7 million, from the theft remains unmoved.
The Homemade Token Trick
The laundering technique follows a four-step process. First, North Korean operators create a token using a public launch tool. Second, they open a liquidity pool pairing the new token with a real asset like NEAR or a stablecoin. Third, they buy the new token with stolen funds from one set of wallets. Finally, they sell it back into the same pool from a second set of wallets that collect the real asset.
At no point do the stolen funds transfer directly between wallets, as the liquidity pool sits in between. To casual observers, the collecting wallets appear as ordinary traders who sold tokens at a profit. Each of the six NEAR tokens cost about 25 NEAR, or around $90, to create. All were heavily traded within hours using stolen NEAR before being abandoned.
Buying Time
The meme coins don't hide funds — every transaction remains visible on the blockchain. Instead, they buy time for launderers. Each extra hop slows investigators while the criminals race to move funds before being flagged. At about $90 per token, they're cheap enough to discard after use.
This approach fits the larger pattern Elliptic has tracked since the theft: over 20,000 wallets across 16 blockchains, at least 36 services, and more than 65,000 transactions. Binance has confirmed the attack began with a fake job interview and operated for five months before any coins moved.
Related
