Binance Hack Update: North Korea Used Elon Musk’s Face to Launder Money

North Korea’s hackers have found a new use for meme coins. They are minting their own, one showing Elon Musk under an “Elon 2028 President” banner, to wash money stolen from Binance, blockchain analytics firm Elliptic said Monday.

Elliptic said Musk has no link to the tokens. About 117,000 NEAR Protocol (NEAR), worth roughly $430,000 by Elliptic’s estimate, has passed through six homemade tokens. Elliptic says exchanges that already accepted money from these trades need to check it again.

$90 Meme Coin Hides Stolen Money

The money comes from the $6.4 billion October theft that the FBI blamed on North Korea.

Each fake token cost about $90 to launch. The launderers paired every one with NEAR in a liquidity pool, an automated swap booth on a decentralized exchange.

One group of wallets bought the token with stolen NEAR. A second group sold it back and walked away with NEAR.

The money never moved straight from thief to receiver. On the blockchain, the sellers looked like lucky traders.

The costumes were American. One logo showed a duck before a US flag. Another carried the Musk banner. Elliptic did not say which of the six tokens carried the Musk image.

Can Exchanges Spot the Laundering?

Almost nobody else touched the coins. Outsiders bought a sliver of one token, under 1% of its trading.

Each coin traded hard within hours, then died. Profits from one paid for the next.

“It does not hide the funds so much as slow down the people tracing them,” read an excerpt in the Elliptic blog, citing Tom Robinson.

Launderers need to cash out before their wallets land on blocklists. The same trick moved at least $24 million after the 2025 Bybit hack.

Why $430,000 May Be Only the Start

About 11.8 million stolen NEAR, worth $43.7 million by Elliptic’s estimate, has not moved yet. The meme coin route has so far handled less than 1% of that pile.

Elliptic stressed that the launch tool, the exchange, and the wallet app did nothing wrong. The launderers used them like any other customer could.

That leaves the burden on whoever receives the money. Elliptic says deposits that exchanges already cleared need a second look as its blocklist grows.