North Korea Is Creating Fake Meme Coins to Launder Millions From the $6.4B Binance Hack
North Korean hackers are creating their own meme coins to launder funds stolen from the $6.4 billion Binance hack, according to blockchain analytics firm Elliptic.
Six meme coins created on NEAR helped North Korean hackers move stolen funds, with almost no genuine trading activity involved. The attackers are using newly launched tokens and decentralized exchange liquidity pools to move funds between wallets without making direct transfers.
Laundering Method
Elliptic flagged the activity on Tron and NEAR, along with a similar method on Solana. The process involves creating a token, pairing it with a legitimate crypto such as NEAR or a stablecoin, and adding it to a liquidity pool on a decentralized exchange.
The attackers then use one set of wallets to buy the newly created token with stolen funds. A separate group of wallets sells those tokens back into the pool and receives the original crypto. This puts the liquidity pool between the wallets, making it harder to immediately connect the funds entering the pool with those coming out.
Evidence of Operation
The blockchain analytics firm first identified the method while tracking funds stolen from Bybit in 2025, where North Korean launderers created a worthless token on Tron to move at least $24 million. The same approach appeared after the Binance theft.
Between November 5 and 7, the attackers created six tokens named FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each was paired with NEAR in a separate liquidity pool. Creating a token cost around 25 NEAR, or approximately $90. The six tokens were then used to move around 117,000 NEAR, worth roughly $430,000.
Almost the same amount later came out through separate wallets, and much of it was converted into stablecoins or transferred through a cross-chain bridge.
Tracking Challenges
Elliptic found that proceeds from previously launched tokens were used to fund the creation of newer ones, connecting the six-token operation. The method does not remove the transaction trail but makes tracking more time-consuming.
At around $90 per token, the cost of creating new ones is low, allowing attackers to repeat the process. The $430,000 moved through the six NEAR tokens represents only a small portion of the stolen funds. Elliptic estimates that around 11.8 million NEAR, worth approximately $43.7 million, remains unmoved.
The firm has warned crypto exchanges against automatically treating funds received from liquidity pools as legitimate. Newly created tokens, pools with few participating wallets, and accounts funded shortly before trading could indicate laundering activity.
Related
