North Korea Launders Billions Stolen From Binance Through Elon Musk-Themed Memecoins - Mezha

North Korean-linked hackers are laundering billions of dollars stolen from Binance by creating and trading their own memecoins, according to blockchain analytics firm Elliptic.

The attackers have already moved around 117,000 NEAR tokens worth approximately $430,000 through six memecoins created between November 5 and 7.

The disposable tokens mostly feature cartoon characters or celebrities in their imagery. One used Elon Musk's face alongside the slogan "Elon 2028 President," although Elliptic stressed that there is no reason to believe the billionaire was involved in creating any of these coins.

Other names follow typical memecoin conventions, including crude jokes and the distinctive "inu" suffix frequently used for dog-themed tokens.

Laundering through liquidity pools

The scheme operates through liquidity pools on decentralized cryptocurrency exchanges. First, one group of wallets exchanges cryptocurrency for newly created memecoins.

Other wallets then sell those tokens through the same pool and receive legitimate cryptoassets. From the outside, this can resemble ordinary trading rather than a transfer of stolen assets.

However, all transactions remain recorded on the blockchain and can therefore be traced, although the additional transfers complicate and slow down investigators' work.

Previous large-scale hacks

This is not the first time North Korea has used a similar strategy. Last year, the same group of North Korean hackers stole $1.5 billion from cryptocurrency exchange Bybit.

Elliptic subsequently found that the cybercriminals had moved at least $24 million of the stolen funds through memecoins.

The Binance hack became the largest theft in cryptocurrency history. After months of careful planning, the hackers managed to withdraw $6.3 billion in cryptoassets in just 20 minutes.

In its own report, the company said the attackers gained access to engineers' work computers through fake job interviews and malware installation, before exploiting Binance's internal AI systems.

The exchange managed to freeze or intercept $2.85 billion of the total, but immediately pledged to allocate all the funds necessary to cover customer losses. As of October 31, 98% of the lost assets had been returned.