North Korea's $6.3B Binance Hack Takes a Strange Turn With Meme Coins - Bitcoin News
North Korean launderers have turned to disposable meme coins to disguise proceeds from Binance's $6.3 billion hack, creating new obstacles for investigators tracking the stolen assets.
North Korean launderers have turned to disposable meme coins to disguise proceeds from Binance's $6.3 billion hack, creating new obstacles for investigators tracking the stolen assets. Elliptic identified related tactics on three blockchains, adding cheap, repeatable obstacles to efforts to trace the stolen assets.
The Federal Bureau of Investigation (FBI) attributed last month's Binance theft to North Korea on Oct. 31, identifying the operation as Tradertraitor, a state-sponsored North Korean group targeting cryptocurrency businesses. However, North Korea denied responsibility for the hack on Nov. 3.
Most people think of meme tokens as joke coins whose prices rise and fall on hype. North Korea's launderers have found a different use for them, creating tokens that nobody else wants to buy and using them to disguise the movement of stolen funds.
Meme Coin Laundering Technique
North Korean launderers used meme coins and obscure tokens on Tron, Solana, and Near blockchains, Elliptic reported. On Near, one group bought new coins with stolen cryptocurrency through token liquidity pools, while other wallets sold into the same pools and collected nearly matching proceeds, separating the sending and receiving addresses.
Six tokens created between Nov. 5 and Nov. 7 handled about 117,000 NEAR ($430,000), with almost no outside trading. Each launch cost about $90. Five creators received funding from earlier token sales shortly before launching replacements.
The attacker attempted to evade freezes through rapid stablecoin conversions, exchanging $325 million in funds for approximately $285 million in ether over nearly 20 minutes. Ether lacks the issuer-controlled freezes available for those stablecoins.
Layered Approach to Obfuscation
North Korea's launderers rarely rely on a single technique, instead layering many cheap methods that add delay to tracking efforts. Elliptic flagged a worthless Tron token created solely for laundering on Nov. 2, and stolen solana moved through thinly traded tokens the next day.
By Nov. 2, stolen assets had passed through approximately 12,000 wallets across 11 blockchains. Fixed timing and blind retries of failed operations without adjustment indicated conventional automation rather than AI-directed decisions.
A wallet that received its funds from a liquidity pool should not be treated as clean by default, as it may sit just two swaps away from stolen funds.
Elliptic tracked conversions into approximately 2,300 bitcoin, worth $175 million then, from assets including solana, XRP, and tron. Converted proceeds reached about 3,000 bitcoin, worth $225 million by Nov. 9.
Related
