North Korean Hackers Utilize Memecoins to Launder Stolen Binance Assets
Hackers exploit NEAR blockchain liquidity pools to obscure $430,000 in illicit Binance funds.
1Laundering via Memecoins
North Korean hackers are deploying memecoins to launder proceeds from a $6.3 billion Binance hack. According to Elliptic, approximately $430,000 was routed through six newly created tokens on the NEAR blockchain between November 5 and 7. These tokens served as temporary vehicles to facilitate complex fund movements between various digital wallets.
2Liquidity Pool Manipulation
The attackers utilized liquidity pools on decentralized exchanges to obscure direct wallet-to-wallet transfers. By swapping stolen NEAR tokens for these memecoins and subsequently selling them back into the pools, the hackers successfully moved assets without traditional transaction paths. Despite this obfuscation, the entire movement of funds remains fully traceable on the blockchain.
3Token Lifecycle Patterns
The six memecoins created for this operation attracted almost no external trading volume and were abandoned shortly after their launch. Elliptic observed that five of these token creators received funding from previous sales just two to 13 minutes before launching new tokens, establishing a clear, linked chain of suspicious transaction activity.
4Strategic Layering Techniques
Tom Robinson, co-founder of Elliptic, notes that North Korean laundering operations rarely depend on a single method. Instead, they employ multiple, low-cost techniques to layer transactions, effectively adding delays to the process. This strategy complicates tracking efforts by forcing investigators to analyze a series of fragmented and rapidly executed on-chain movements.
5Historical Operational Precedent
This specific laundering methodology mirrors tactics observed following the $1.5 billion Bybit hack in 2025. During that incident, actors linked to North Korea moved at least $24 million through a newly created token on the TRON blockchain. The recurrence of this pattern suggests a standardized approach to obfuscating stolen digital assets.
6Remaining Stolen Reserves
Despite the ongoing laundering efforts, a significant portion of the stolen assets remains stationary. Elliptic reports that approximately 11.8 million NEAR tokens, valued at roughly $43.7 million, have not yet been moved from the original wallets associated with the Binance hack. These funds remain under close observation by blockchain analytics firms.
7Blockchain Traceability Challenges
While memecoins provide a layer of complexity, the inherent transparency of blockchain ledgers limits the effectiveness of this laundering technique. Every swap and liquidity pool interaction is recorded on-chain, allowing analysts to map the flow of funds. The hackers' reliance on these tokens highlights the difficulty of moving large-scale stolen crypto assets.
8Future Monitoring Requirements
As North Korean actors continue to innovate their laundering strategies, monitoring liquidity pool activity on smaller chains like NEAR becomes critical. The shift toward using ephemeral tokens demonstrates a need for real-time detection of suspicious wallet funding patterns. Future investigations will focus on the remaining $43.7 million in unmoved stolen assets.