North Korea-Linked Launderers Move $430K From Binance Hack Through Homemade Memecoins

Six Throwaway Tokens Minted on NEAR

Launderers tied to North Korea created six throwaway tokens to disguise roughly $430,000 in transfers connected to the $6.4 billion Binance hack, according to a Nov. 9 report from blockchain analytics firm Elliptic, written by co-founder and chief scientist Tom Robinson. The operators minted tokens named FUK, OLCCL, MEILI, MMLI, DABI and SINU between Nov. 5 and Nov. 7, paying about 25 NEAR, or roughly $90, to create each memecoin.

The scheme ran through liquidity pools on a decentralized exchange. The launderers paired every token with NEAR in its own pool, then routed approximately 117,000 stolen NEAR through them. One cluster of wallets bought tokens with the stolen cryptocurrency, while a second cluster sold those same tokens back into the pool and collected real assets. With the pool sitting between the two groups, no wallet transferred funds directly to another, so receiving accounts could resemble traders taking profits rather than hack proceeds.

Almost all turnover came from wallets tied to the operation, with outside buyers accounting for less than 1% of one token's volume, and trading across all six tokens stopped by Nov. 8. One token carried an image of Elon Musk under an “Elon 2028 President” banner, though Elliptic said there is no indication Musk has any connection to the tokens; their names otherwise followed standard conventions, including a crude joke and dog-themed suffixes.

The technique predates this theft. Elliptic identified the same playbook after the 2025 Bybit hack, and its stated effect is to delay investigators, since cheaply created tokens are simply discarded afterward. The firm's assessment is that the trail can still be followed on-chain, and it cautioned compliance teams not to treat funds arriving from a liquidity pool as clean by default.

7,000 ETH Reaches Tornado Cash

The memecoin route is a small slice of a far larger operation. A separate Elliptic laundering tracker, updated Nov. 9 at 13:15 UTC, charts stolen funds across more than 20,000 wallets on 16 blockchains, touching at least 36 services and roughly 65,000 transactions. Since Nov. 8, theft-linked wallets have deposited about 7,000 ETH, valued near $15 million, into Tornado Cash, with some deposits originating from bitcoin that had already passed through coinjoin transactions before being converted back into ether.

Around 3,000 BTC, worth roughly $225 million, had accumulated in newly created addresses after conversions from other stolen assets, while the main Bitcoin and Ether holdings had not moved. Approximately $3 billion remains in theft-linked addresses and $2.85 billion is frozen, with only a negligible amount likely cashed out. The FBI attributed the Oct. 29 theft to North Korea's TraderTraitor group on Oct. 31 and urged services, including THORChain operators, to block linked transactions; the hackers have also used THORChain to convert stolen assets into bitcoin, which no central issuer can freeze.

Binance's own account of the breach, published Nov. 3, describes a months-long intrusion built on fake recruitment interviews and tampered developer software. During a September interview process, an engineer downloaded an assignment repository onto a work computer, and malicious code replaced a legitimate development tool without tripping endpoint security. On Oct. 20 the attacker used that machine and an internal AI tool to reach two wallet engineers' computers, and stolen container deployment credentials then provided access to wallet signing operations. Blockaid's technical findings identified 50 EIP-7702 authorizations submitted in a single transaction, covering consecutive counter values of the actively used wallet. Binance put the impact at $6.34 billion and said it has set aside more than the full amount to cover losses. Recovery also runs through governance: 8,425.997 ETH and 74.56 million ARB frozen on Arbitrum can only move again with DAO approval, in a process Binance estimates will take seven weeks or longer.

The laundering design confirms what the on-chain record showed after previous North Korean thefts: obfuscation slows tracing but does not break it. Every hop in the memecoin scheme, from pool creation to the Tornado Cash deposits, sits on public ledgers, and the tracker ties roughly $3 billion in remaining proceeds to identifiable addresses. The root cause, per Binance's post-mortem, was endpoint compromise through a poisoned development tool rather than a leaked private key, which places the remediation burden on operational security instead of key rotation. With $2.85 billion frozen and the Arbitrum balances awaiting a DAO vote, recovery now depends on governance timelines as much as on investigative work.