North Korean hackers linked to Binance heist use memecoins to launder funds

Hackers tied to North Korea, who stole $6.4 billion from Binance, the largest cryptocurrency exchange globally, are suspected of cleaning the illicit funds through memecoins on TRON, Solana, and NEAR blockchains, according to a report.

Crypto analytics firm Elliptic has connected approximately $430,000 in NEAR tokens to the launch of six memecoins with animal themes, such as ducks and chimpanzees.

One of those digital tokens promotes Elon Musk as a candidate for the US presidency in 2028.

The revenue from selling these tokens roughly matches the amount initially invested.

Elliptic suspects the tokens served a money-laundering purpose, citing a lack of outside trading activity, payment from a prior token launch's proceeds, and a brief trading window followed by permanent disuse.

The firm further notes that memecoins draw minimal scrutiny, cost only $90 each to create, and complicate investigators' tracking by adding steps to the path of stolen funds.

Laundering group holds over $43M in NEAR tokens

The memecoins were funded from a crypto wallet belonging to the hacking group TraderTraitor, which held roughly $43.7 million in NEAR.

Stolen assets were also identified moving to one token on the TRON blockchain and another on Solana.

Elliptic did not disclose the tool used to generate the tokens or the decentralized exchange where the funds were sent. It noted only that these platforms “did nothing wrong; the launderers simply used them as any other user could.”

Not TraderTraitor's first memecoin operation

Elliptic observed TraderTraitor employing the same memecoin laundering technique after last year's $1.5 billion Bybit hack.

In that instance, the group used TRON-based memecoins and is reported to have moved at least $24 million.