Binance hackers made memecoins to launder stolen crypto - The Straits Times

The hackers behind crypto's largest ever theft have employed memecoins to launder a portion of the US$6.3 billion stolen from Binance. Blockchain analytics firm Elliptic reported that at least six new tokens were created on the NEAR blockchain network shortly after the theft, allowing attackers to move approximately US$430,000 of the stolen crypto.

The scheme aimed to obscure the trail of money rather than deceive traders into exchanging stolen assets for legitimate funds. Each of the six tokens—FUK, OLCCL, MEILI, MMLI, DABI, and SINU—traded heavily for a few hours before being abandoned. The hackers used stolen NEAR tokens to purchase these memecoins on decentralized exchanges, receiving the stolen NEAR in unconnected wallets.

Memecoin strategy

The memecoins featured typical memecoin logos, including one showing a monkey wearing a pink bow and another with Elon Musk under an 'Elon 2028 President' banner. There is no indication that Tesla's CEO has any connection to these tokens. Tom Robinson, Elliptic's founder and chief scientist, explained that memecoins attract little attention as most fade within days, making them ideal for laundering purposes.

Laundering scale

The laundering operation has been massive in scale. Within a week of the October 29 hack, the effort used over 20,000 wallets and executed at least 65,000 transactions—roughly one new wallet every 30 seconds and one transaction every 10 seconds. About US$44 million in stolen NEAR remains untouched, while approximately US$3.13 billion remains with the hackers, mostly in Bitcoin and Ether.

Binance co-CEO Richard Teng reported that US$2.85 billion of the stolen crypto has been frozen or intercepted, largely in stablecoins where issuers like Tether and Circle can prevent conversion to cash. The hackers likely chose Bitcoin and Ether because they cannot be frozen by issuers, allowing more time for laundering.

Previous patterns

This memecoin laundering tactic was first observed in 2025 following another heist where suspected North Korean hackers laundered at least US$24 million stolen from crypto exchange Bybit. US authorities have attributed the Binance hack to North Korea's TraderTraitor group. The hackers have also used privacy-focused networks like THORChain, Privacy Cash, and Wasabi Wallet to execute trades.