North Korea Launders Binance Theft Funds Through Custom Meme Coins

On Monday, blockchain analytics company Elliptic reported that North Korean money launderers are generating their own worthless meme tokens and routing stolen funds from the Binance hack through them. This prevents the coins from ever moving directly between wallets.

Between November 5 and 7, the operators launched at least six new tokens on the NEAR blockchain — FUK, OLCCL, MEILI, MMLI, DABI and SINU. Each was paired with NEAR in its own liquidity pool. They then purchased these tokens with stolen NEAR and sold them back via a separate set of wallets. Elliptic recorded roughly 117,000 NEAR, worth approximately $430,000, flowing through these six tokens.

This activity is part of the broader effort to launder the October 29 Binance theft. The exchange has valued the theft at $6.34 billion, and the FBI has linked it to North Korea's TraderTraitor group. Elliptic's updated analysis now identifies roughly 3,000 BTC — about $225 million — moved into new bitcoin addresses from other stolen assets, while approximately 11.8 million NEAR, or $43.7 million, from the theft remains unmoved.

“Most people think of meme tokens as joke coins whose prices rise and fall on hype,” said Elliptic co-founder and chief scientist Dr. Tom Robinson. “North Korea’s launderers have found a different use for them.”

How the homemade token trick works

This technique involves a four-step process. The North Korean launderers create a token using a public launch tool, establish a liquidity pool that pairs it with a real asset like NEAR or a stablecoin, purchase the new token with stolen funds from one set of wallets, and then sell it back into the same pool from a second wallet set that collects the real asset.

Because the pool acts as an intermediary, the stolen funds never go directly from a buying wallet to a collecting wallet. To an outside observer, the collecting wallets appear to be ordinary traders who sold a token at a profit.

Each of the six NEAR tokens cost around 25 NEAR, or roughly $90, to create. They were heavily traded for several hours using stolen NEAR and then abandoned. None have traded since November 8, and that afternoon the creators of four of them withdrew the remaining liquidity. Five of the six token creators were funded by a wallet that had just sold an earlier token, between two and 13 minutes before the next launch, forming a chain of tokens.

Elliptic previously documented this same method in the laundering of the February 2025 Bybit theft, also blamed on North Korea's TraderTraitor group, where a worthless Tron token helped move at least $24 million. In the Binance case, Elliptic has also observed the technique on Tron and a close variant on Solana that used existing thinly traded tokens instead of homemade ones.

A slowing tactic, not a disappearing act

The meme coins do not conceal the funds; every step is public on the blockchain. What they provide is time. Each additional hop slows down investigators as launderers race to move funds before they get flagged. At about $90 each, the tokens are cheap enough to discard.

This matches the broader pattern Elliptic has tracked since the theft: over 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions. Binance has stated that the attack began with a fake job interview and ran for five months before any coins moved. Blockchain firms connected the breach to TraderTraitor within a day.

The conversion into bitcoin represents the larger financial story. All of the stolen SOL has already been swapped, bridged or mixed, and much of the XRP route has also gone into bitcoin. Approximately $2.85 billion of the original haul has been frozen. Elliptic said a negligible amount has likely been cashed out so far.

North Korea's crypto theft operations are not new. Elliptic estimated the regime's 2025 haul at above $2 billion, driven by the $1.46 billion Bybit exploit, with its cumulative known total exceeding $6 billion even before the Binance incident.

Binance has gradually resumed withdrawals and said it covered customer losses from its own funds. The challenge for investigators is whether homemade liquidity pools will keep multiplying faster than the blocklists that catch up to them.