North Korean Hackers Create Fake Meme Coins to Launder Stolen Funds From $6.4 Billion Binance Hack - CyberSecurityNews

The operation places decentralized exchange liquidity pools between wallets holding stolen assets and wallets collecting the proceeds, complicating efforts to trace and freeze the money. The laundering follows the October 29, 2026, theft attributed to TraderTraitor, a North Korean hacking group. Earlier reporting on the FBI's North Korean attribution connected the Binance attack to an operation previously blamed for major cryptocurrency thefts.

Researchers from Elliptic identified the meme coin laundering activity in a November 9 investigation led by co-founder Dr. Tom Robinson. Their report examines blockchain transactions rather than identifying a new malware family. It documents related techniques on Tron, NEAR, and Solana, with approximately 117,000 NEAR, worth around $430,000, passing through six newly created tokens.

How the Laundering Works

The process starts with attackers creating a token through a public launch tool. They then establish a liquidity pool pairing that token with a genuine asset, such as NEAR or a stablecoin. A liquidity pool holds assets that users can exchange without a traditional buyer and seller matching each trade.

One group of attacker-controlled wallets uses stolen cryptocurrency to purchase the new token. Another group sells tokens into the same pool and withdraws the genuine asset. Because the pool sits between these transactions, funds do not move directly from the buying wallets to the collecting wallets.

Pattern of Fake Tokens

Between November 5 and November 7, the operators created six NEAR tokens: FUK, OLCCL, MEILI, MMLI, DABI, and SINU. Each cost approximately 25 NEAR, or $90, to launch. Their logos copied familiar meme coin imagery, including animals and an Elon Musk-themed banner.

Elliptic explicitly stated that nothing suggested Musk had any connection to the tokens. This method builds on earlier laundering after the Bybit theft. While the earlier Bybit attack investigation described workstation compromise and malicious transaction changes, Elliptic's research concerns what happened afterward.

The Binance-linked NEAR tokens followed a consistent pattern. They launched, traded heavily within hours, and were abandoned. None had traded since November 8 when Elliptic published its findings. Creators of four tokens also withdrew remaining pool liquidity that afternoon, reinforcing the assessment that these were temporary laundering tools rather than genuine trading projects.

Blockchain Evidence

Elliptic found that laundering-network wallets accounted for every sale across all six tokens. They also bought every unit of five tokens. FUK attracted limited outside purchases, but these represented less than 1% of its volume. DABI, MMLI, and SINU each had only one buying wallet and one selling wallet.

Five token creators received money from wallets that had already sold an earlier token, just two to thirteen minutes before launching the next one. Almost the same amount of NEAR entering the scheme later left collecting wallets, often heading into stablecoins or cross-chain bridges.

The activity remains traceable because transactions stay on public blockchains. Elliptic advises compliance teams against treating liquidity-pool withdrawals as automatically legitimate. Newly launched tokens, very few traders, separate buying-only and selling-only wallets, and accounts funded immediately before trading deserve scrutiny.